70 CIT ANNUAL REPORT 2011

Student Lending (Student Loan Xpress or “SLX”) CIT’s Xpress Loan Servicing offices in Cleveland and Cincinnati, Consumer includes our liquidating student loan portfolio. During Ohio were closed. 2011, we sold $1.3 billion in loans and outsourced the servicing of See Note 8 — Long-Term Borrowings for description of the government-guaranteed student loan portfolio. As a result, related financings.

Student Lending Receivables, including held for sale, by Product Type (dollars in millions) At December 31, 2011 2010 2009 Consolidation loans $5,315.7 $7,119.0 $7,559.3 Other U.S. Government guaranteed loans 1,014.2 1,159.2 1,888.4 Private (non-guaranteed) loans and other 1.8 2.7 136.5 Total $6,331.7 $8,280.9 $9,584.2 Delinquencies (sixty days or more) $ 513.5 $ 608.9 $ 658.8 Top state concentrations (%) 36% 35% 36% Top state concentrations California, New York, Texas, Ohio, Pennsylvania

RISK MANAGEMENT

We are subject to a variety of risks that can manifest themselves Officer or delegate manages the risk and the CRO provides in the course of the business that we operate in. We consider the independent oversight. following to be the principal forms of risk: The Credit Risk Management (“CRM”) group, which reports to - Credit and asset risk (including lending, leasing, counterparty, the CRO, manages and approves all credit risk throughout CIT. equipment valuation and residual risk) This group is run by the Chief Credit Officer (“CCO”), and - Market risk (including interest rate and foreign currency) includes the heads of credit for each business unit, the head - Liquidity risk of Problem Loan Management, Credit Control and Credit Admin- - Legal, regulatory and compliance risks (including compliance istration. The Corporate Credit Committee (“CCC”), Credit with laws and regulations) Policy Committee and Criticized Asset Committee each report - Operational risks (risk of financial loss or potential damage to a into the CCO. firm’s reputation, or other adverse impacts resulting from The risk management function includes an independent Loan inadequate or failed internal processes and systems, people or Risk Review function (“LRR”), which reports to the Risk Manage- external events) ment Committee of the Board and administratively into the CRO. Managing risk is essential to conducting our businesses and to LRR reviews credit management processes in each business and our profitability. This starts with defining our risk appetite, setting monitors compliance with corporate policies. LRR also tests for risk acceptance criteria, and establishing credit authorities, limits adherence to credit policies and procedures and for inappropri- and target performance metrics. Ensuring appropriate risk gover- ate credit practices, including problem account identification and nance and oversight includes establishing and enforcing policies, reporting. This group also reviews credit grading, non-accruals procedures and processes to manage risk. Adequately identify- and charge-off practices. ing, monitoring and reporting on risk is essential to ensure that The Credit Portfolio Risk group (“CPR”) is responsible for credit actions are taken to proactively manage risk. This requires data, models, analytics and reporting. Enterprise Risk Manage- appropriate data, tools, models, analytics and management ment (“ERM”) is responsible for oversight of market risk (foreign information systems. Finally, ensuring the appropriate expertise exchange and interest rate), liquidity risk, asset risk, operational through staffing and training is key to effective risk management. risk, counterparty risk, country and industry risk, new product risk We continued to strengthen our risk management practices, and independent model validation. including reviewing, revising, updating and enhancing each of these areas in 2011. The Asset Liability Committee has primary authority and respon- sibility to establish strategies regarding funding, capital, market SUPERVISION AND OVERSIGHT and liquidity risks arising from CIT’s businesses. The Chief Risk Officer (“CRO”) or delegate manages credit The Compliance function reports into the Audit Committee of risk and asset risk (transactional and portfolio), country risk, the Board and administratively into the CRO. Global Regulatory industry risk, operational risk, model risk, compliance risk and Relations reports to the CRO. The Risk Management Committee regulatory relations globally, across the Company. Together of the Board oversees credit, asset, market, liquidity, opera- these groups form the Corporate Risk Management team. For tional and information technology (“IT”) risk management market risk and liquidity risk management, the Chief Financial practices. The Audit and the Special Compliance Committees of