Management’s discussion and analysis COMPLIANCE RISK MANAGEMENT Overview Code of Conduct Governance and oversight JPMorgan Chase & Co./2020 Form 10-K 148 Compliance risk, a subcategory of operational risk, is the risk of failing to comply with laws, rules, regulations or codes of conduct and standards of self-regulatory organizations. Each LOB and Corporate hold primary ownership of and accountability for managing compliance risk. The Firm’s Operational Risk and Compliance Organization (“Operational Risk and Compliance”), which is independent of the LOBs and Corporate, provides independent review, monitoring and oversight of business operations with a focus on compliance with the laws, rules, and regulations applicable to the delivery of the Firm’s products and services to clients and customers. These compliance risks relate to a wide variety of laws, rules and regulations depending on the LOB and the jurisdiction, and include risks related to financial products and services, relationships and interactions with clients and customers, and employee activities. For example, compliance risks include those associated with anti-money laundering compliance, trading activities, market conduct, and complying with the laws, rules, and regulations related to the offering of products and services across jurisdictional borders. Compliance risk is also inherent in the Firm’s fiduciary activities, including the failure to exercise the applicable standard of care (such as the duties of loyalty or care), to act in the best interest of clients and customers or to treat clients and customers fairly. Other functions provide oversight of significant regulatory obligations that are specific to their respective areas of responsibility. Operational Risk and Compliance implements policies and standards designed to govern, identify, measure, monitor and test, manage, and report on compliance risk. Employees can report any potential or actual violations of the Code through the JPMC Conduct Hotline by phone or the internet. The Hotline is anonymous, except in certain non-U.S. jurisdictions where laws prohibit anonymous reporting, and is available at all times globally, with translation services. It is administered by an outside service provider. The Code prohibits retaliation against anyone who raises an issue or concern in good faith. Periodically, the Audit Committee receives reports on the Code of Conduct program. Operational Risk and Compliance is led by the Firm’s Global CCO and FRE for Operational Risk. The Firm maintains oversight and coordination of its compliance risk through the implementation of the CCOR Risk Management Framework. The Firm’s CCO also provides regular updates to the Audit Committee and the Board Risk Committee. In certain Special Purpose Committees of the Board have previously been established to oversee the Firm’s compliance with regulatory Consent Orders. The Firm has a Code of Conduct (the “Code”) that sets forth the Firm’s expectation that employees will conduct themselves with integrity at all times and provides the principles that govern employee conduct with clients, customers, shareholders and one another, as well as with the markets and communities in which the Firm does business. The Code requires employees to promptly report any potential or actual violation of the Code, any internal Firm policy, or any law or regulation applicable to the Firm’s business. It also requires employees to report any illegal conduct, or conduct that violates the underlying principles of the Code, by any of the Firm’s employees, clients, customers, suppliers, contract workers, business partners, or agents. All newly hired employees are assigned Code training and current employees are periodically assigned Code training on an ongoing basis. Employees are required to affirm their compliance with the Code periodically.