Exelon Corporation: 10-K Risk Factor Changes

Substantial aspects of the Registrants' businesses are subject to comprehensive Federal or state legislation and/or regulation. The Utility Registrants' consolidated financial statements are heavily dependent on the ability of the Utility Registrants to recover their costs for the retail purchase, transmission, and distribution of power and natural gas to their customers. 24 24 24 Table of Contents Table of Contents Fundamental changes in laws or regulations or adverse legislative or regulatory actions affecting the Registrants’ businesses would require changes in their business planning models and operations. Registrants cannot always predict when or whether legislative or regulatory action will occur and may not be able to influence the outcome of legislative or regulatory initiatives.

Substantial aspects of the Registrants' businesses are subject to comprehensive Federal or state legislation and/or regulation. The Utility Registrants' consolidated financial statements are heavily dependent on the ability of the Utility Registrants to recover their costs for the retail purchase, transmission, and distribution of power and natural gas to their customers. Fundamental changes in regulations or adverse legislative actions affecting the Registrants’ businesses would require changes in their business planning models and operations. The Registrants cannot predict when or whether legislative or regulatory proposals could become law or what their effect would be on the Registrants. 26 26 26 Table of Contents Table of Contents

The Utility Registrants’ businesses are capital intensive and require significant investments in transmission and distribution infrastructure projects. Equipment, even if maintained in accordance with good utility practices, is subject to operational failure, including events that are beyond the Utility Registrants’ control, and could require significant expenditures to operate efficiently. Disruptions or cost increases in the supply chain, including shortages in labor, materials or parts, could materially impact the timing and execution of capital projects, as well as other aspects of the Registrants' businesses. The Registrants' consolidated financial statements could be negatively affected if they were unable to effectively manage their capital projects or raise the necessary capital, or if they are deemed liable for operational failure. See ITEM 7. MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS — Liquidity and Capital Resources for additional information regarding the Registrants’ potential future capital expenditures.

The Utility Registrants’ businesses are capital intensive and require significant investments in transmission and distribution infrastructure projects. Equipment, even if maintained in accordance with good utility practices, is subject to operational failure, including events that are beyond the Utility Registrants’ control, and could require significant expenditures to operate efficiently. Additionally, if critical parts are not available, it may impact the timing of execution of capital projects. The Registrants' consolidated financial statements could be negatively affected if they were unable to effectively manage their capital projects or raise the necessary capital, or if they are deemed liable for operational failure. See ITEM 7. MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS — Liquidity and Capital Resources for additional information regarding the Registrants’ potential future capital expenditures.

Risks from cybersecurity and physical threats to energy infrastructures are increasing. Threat actors, including sophisticated nation-state actors, continue to seek to exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures, and attacks and disruptions, both physical, cyber, and hybrid targeting physical and cyber assets, are becoming increasingly sophisticated and dynamic. Several U.S. government agencies have warned of increased risks related to physical attacks, ransomware attacks and cybersecurity threats related to the energy sector and its supply chains, and that the risks may escalate during periods of heightened geopolitical tensions. Continued implementation of advanced digital technologies increases the potentially unfavorable impacts of such attacks. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify the Registrants' cybersecurity risks. A security breach of the Registrants' physical assets or information systems or those of the Registrants' competitors, vendors, business partners and interconnected entities (including RTOs and ISOs) could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data. The Registrants' reliance on vendors to provide services and equipment, and its shared information systems with Constellation pursuant to the Transition Services Agreement between Exelon and Constellation, increases the risk to assets, systems, and data. While some of the Registrants' vendors have experienced cybersecurity incidents, such incidents have not, to Registrants' knowledge, resulted in material impact to any of the Registrants to date. The risk of these events and security breaches occurring continues to intensify. The Registrants have been, and will likely continue to be, subjected to physical and cyber-attacks. While to date none of the Registrants has directly experienced a material breach or material disruption to its network or information systems or operations, as such attacks continue to increase in sophistication and frequency, the Registrants may be subject to a material breach or material disruption in the future. If a significant physical or cybersecurity breach or disruption were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants could be diminished and the Registrants could be subject to legal claims, regulatory exposure, loss of revenues, increased costs including for infrastructure repairs, or operations shutdown, all of which could materially affect the Registrants' financial condition and materially damage its business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any disruptions to business that could result. The continued increase in Federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to current measures taken by the Registrants or to their business operations and could adversely affect their consolidated financial statements.

The Registrants face physical security and cybersecurity risks. Threat sources, including sophisticated nation-state actors, continue to seek to exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures, and these attacks and disruptions, both physical and cyber, are becoming increasingly sophisticated and dynamic. Continued implementation of advanced digital technologies increases the potentially unfavorable impacts of such attacks. Additionally, the U.S. government has warned that the Ukraine conflict may increase the risks of attacks targeting critical infrastructure in the United States. A security breach of the Registrants' physical assets or information systems or those of the Registrants competitors, vendors, business partners and interconnected entities in RTOs and ISOs, or regulators could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, sensitive customer, vendor, or employee data, or other confidential data. The risk of these events and security breaches occurring continues to intensify, and while the Registrants have been, and will likely continue to be, subjected to physical and cyber-attacks, to date none have directly experienced a material breach or material disruption to its network or information systems or our operations. However, as such attacks continue to increase in sophistication and frequency, the Registrants may be unable to prevent all such attacks in the future. If a significant security breach were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants or others in the industry could be diminished, or the Registrants could be subject to legal claims, loss of revenues, increased costs, or operations shutdown. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches may not be sufficient to cover losses or otherwise adequately compensate for any disruptions to business that could result. The Utility Registrants' deployment of smart meters throughout their service territories could increase the risk of damage from an intentional disruption of the system by third parties. In addition, new or updated security regulations or unforeseen threat sources could require changes in current measures taken by the Registrants or their business operations and could adversely affect their consolidated financial statements.

The Utility Registrants' infrastructures and/or operations could be affected by extreme weather events, natural disasters, or operational accidents such as wildfires or natural gas explosions which could result in increased costs, including supply chain costs and third-party property damage. An extreme weather event, natural disaster, or operational accident within the Utility Registrants’ service areas can also directly affect their capital assets, causing disruption in service to customers due to downed wires and poles or damage to other operating equipment. The impact that potential terrorist attacks could have on the industry and the Registrants is uncertain. The Registrants face a risk that their operations would be direct targets or indirect casualties of an act of terror. Any retaliatory military strikes or sustained military campaign could affect Registrants' operations in unpredictable ways, such as changes in insurance markets and disruptions of supplies and markets. Furthermore, such events could compromise the physical or cybersecurity of the Registrants' facilities, which could adversely affect the Registrants' ability to manage their businesses effectively. Instability in the financial markets as a result of terrorism, war, natural disasters, public health crises, epidemics, pandemics, credit crises, recession, or other significant events also could result in a decline in energy consumption or interruption of fuel or the supply chain. In addition, the implementation of security guidelines and measures has resulted in and is expected to continue to result in increased costs. The Registrants could be significantly affected by public health crises, epidemics, or pandemics. The Registrants have plans in place to respond to such events. However, depending on the severity and the resulting impacts to workforce and other resource availability, a public health crisis, epidemic, or pandemic could adversely affect our vendors, or customers and customer demand as well as the Registrants’ ability to operate their transmission and distribution assets. In addition, on behalf of the Registrants Exelon maintains a level of insurance coverage consistent with industry practices against property, casualty, and cybersecurity losses subject to unforeseen occurrences or catastrophic events that could damage or destroy assets or interrupt operations. However, there can be no assurance that the amount of insurance will be adequate to address such property and casualty losses.

The Utility Registrants' distribution and transmission infrastructures could be affected by natural disasters and extreme weather events, which could result in increased costs, including supply chain costs. An extreme weather event within the Utility Registrants’ service areas can also directly affect their capital assets, causing disruption in service to customers due to downed wires and poles or damage to other operating equipment. The impact that potential terrorist attacks could have on the industry and the Registrants is uncertain. The Registrants face a risk that their operations would be direct targets or indirect casualties of an act of terror. Any retaliatory military strikes or sustained military campaign could affect their operations in unpredictable ways, such as changes in insurance markets and disruptions of fuel supplies and markets, particularly oil. Furthermore, these catastrophic events could compromise the physical or cybersecurity of the Registrants' facilities, which could adversely affect the Registrants' ability to manage their businesses effectively. Instability in the financial markets as a result of terrorism, war, natural disasters, pandemic, credit crises, recession, or other factors also could result in a decline in energy consumption or interruption of fuel or the supply chain. In addition, the implementation of security guidelines and measures has resulted in and is expected to continue to result in increased costs. The Registrants could be significantly affected by the outbreak of a pandemic. Exelon has plans in place to respond to a pandemic. However, depending on the severity of a pandemic and the resulting impacts to workforce and other resource availability, the ability to operate Exelon's transmission and distribution assets could be adversely affected. In addition, Exelon maintains a level of insurance coverage consistent with industry practices against property, casualty, and cybersecurity losses subject to unforeseen occurrences or catastrophic events that could damage or destroy assets or interrupt operations. However, there can be no assurance that the amount of insurance will be adequate to address such property and casualty losses.

On July 17, 2020, ComEd entered into a Deferred Prosecution Agreement with the USAO for the Northern District of Illinois to resolve the USAO’s investigation into Exelon’s and ComEd’s lobbying activities in the State of Illinois. Exelon was not made a party to the DPA and no charges were brought against Exelon. Under the DPA, the USAO filed a single charge alleging that ComEd improperly gave and offered to give jobs, vendor subcontracts, and payments associated with those jobs and subcontracts for the benefit of the Speaker of the Illinois House of Representatives and the Speaker’s associates, with the intent to influence the Speaker’s action regarding legislation affecting ComEd’s interests. The DPA provided that the USAO would defer any prosecution of such charge and any other criminal or civil case against ComEd in connection with the matters identified therein for a three-year period. That period expired, and the pending charge was dismissed, in July 2023. In October 2019, the SEC notified Exelon and ComEd that it had opened an investigation into their lobbying activities in the state of Illinois. On September 28, 2023, Exelon and ComEd reached a settlement with the SEC to fully resolve the matter. The DPA and the settlement with the SEC could have a material adverse impact on Exelon’s and ComEd’s reputation or relationships with regulatory and legislative authorities, customers, and other stakeholders. Those impacts could affect, or make more difficult, their efforts to achieve actions or approvals associated with operations. See Note 18 — Commitments and Contingencies of the Combined Notes to Consolidated Financial Statements for more information regarding the DPA and SEC settlement.

On July 17, 2020, ComEd entered into a Deferred Prosecution Agreement (DPA) with the U.S. Attorney’s Office for the Northern District of Illinois (USAO) to resolve the USAO’s investigation into Exelon’s and ComEd’s lobbying activities in the State of Illinois. Exelon was not made a party to the DPA and the investigation by the USAO into Exelon’s activities ended with no charges being brought against Exelon. Under the DPA, the USAO filed a single charge alleging that ComEd improperly gave and offered to give jobs, vendor subcontracts, and payments associated with those jobs and subcontracts for the benefit of the Speaker of the Illinois House of Representatives and the Speaker’s associates, with the intent to influence the Speaker’s action regarding legislation affecting ComEd’s interests. The DPA provides that the USAO will defer any prosecution of such charge and any other criminal or civil case against ComEd in connection with the matters identified therein for a three-year period subject to certain obligations of ComEd, including, but not limited to, the following: (i) payment to the U.S. Treasury of $200 million; (ii) continued full cooperation with the government’s investigation; and (iii) ComEd’s adoption and maintenance of remedial measures involving compliance and reporting undertakings as specified in the DPA. If ComEd is found to have breached the terms of the DPA, the USAO may elect to prosecute, or bring a civil action against, ComEd for conduct alleged in the DPA or known to the government, which could result in fines or penalties and could have an adverse impact on Exelon’s and ComEd’s reputation or relationships with regulatory and legislative authorities, customers and other stakeholders, as well as their consolidated financial statements. See Note 18 — Commitments and Contingencies of the Combined Notes to Consolidated Financial Statements.