Fifth Third Bancorp: 10-K Risk Factor Changes

Global financial markets, including the United States, face political and economic uncertainties (such as recent budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit) that may delay investment and hamper economic activity. International events such as trade disputes, separatist movements, leadership changes and political and military conflicts (such as the ongoing military tension between Russia and Ukraine and the evolving conflict in Israel and Gaza) could adversely affect global financial activity and markets and could negatively affect the U.S. economy. The United States is also facing a potentially contentious Presidential election as well as elections to determine the control of Congress and State governments. Additionally, the FRB and other major central banks have removed or reduced monetary accommodation and raised interest rates, increasing the risk of recession and may also negatively impact asset values and credit spreads that were impacted by extraordinary monetary stimulus. These potential negative effects on financial markets and economic activity could lead to reduced revenues, increased costs, increased credit risks and volatile markets, could adversely impact Fifth Third’s ability to raise liquidity via money and capital markets, and could negatively impact Fifth Third’s businesses, results of operations and financial condition.

Global financial markets, including the United States, face political and economic uncertainties (such as recent budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit) that may delay investment and hamper economic activity. International events such as trade disputes, separatist movements, leadership changes and political and military conflicts (such as the ongoing military tension between Russia and Ukraine) could adversely affect global financial activity and markets and could negatively affect the U.S. economy. Additionally, the FRB and other major central banks have begun the process of removing or reducing monetary accommodation, increasing the risk of recession and may also negatively impact asset values and credit spreads that were impacted by extraordinary monetary stimulus. These potential negative effects on financial markets and economic activity could lead to reduced revenues, increased costs, increased credit risks and volatile markets, could adversely impact Fifth Third’s ability to raise liquidity via money and capital markets, and could negatively impact Fifth Third’s businesses, results of operations and financial condition.

Fifth Third’s income and cash flows depend to a great extent on the difference between the interest rates earned on interest-earning assets such as loans and investment securities and the interest rates paid on interest-bearing liabilities such as deposits and borrowings. These rates are highly sensitive to many factors that are beyond Fifth Third’s control, including general economic conditions in the U.S. or abroad and the 35 Fifth Third Bancorp 35 Fifth Third Bancorp 35 Fifth Third Bancorp Table of Contents Table of Contents policies of various governmental and regulatory agencies (in particular, the FRB). Changes in monetary policy, including changes in interest rates and inflation, could influence the origination of loans, the prepayment speed of loans, the purchase of investments, the generation of deposits and the rates received on loans and investment securities and paid on deposits or other sources of funding as well as customers’ ability to repay loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have a material adverse effect on Fifth Third’s financial condition and results of operations. The impact of these changes may be magnified if Fifth Third does not effectively manage the relative sensitivity of its assets and liabilities to changes in market interest rates. Fluctuations in these areas may adversely affect Fifth Third, its customers and its shareholders. Throughout 2022 and 2023, the Federal Reserve raised the federal funds rate to its current targeted rate between 5.25% and 5.5% in an effort to curb inflation. As inflation increases and market interest rates rise, the value of Fifth Third’s investment securities, particularly those that have fixed rates or longer maturities, could decrease. Increasing rates would also increase debt service requirements for some of Fifth Third’s borrowers and may adversely affect those borrowers’ ability to pay as contractually obligated and could result in additional delinquencies or charge-offs. Further, the increase in market interest rates is likely to reduce Fifth Third’s loan origination volume, particularly refinance volume, and/or reduce its interest rate spread, which could have an adverse effect on Fifth Third’s profitability and results of operations. Fifth Third cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on Fifth Third’s activities and financial results.

Fifth Third’s income and cash flows depend to a great extent on the difference between the interest rates earned on interest-earning assets such as loans and investment securities and the interest rates paid on interest-bearing liabilities such as deposits and borrowings. These rates are highly sensitive to many factors that are beyond Fifth Third’s control, including general economic conditions in the U.S. or abroad and the policies of various governmental and regulatory agencies (in particular, the FRB). Changes in monetary policy, including changes in interest rates and inflation, could influence the origination of loans, the prepayment speed of loans, the purchase of investments, the generation of deposits and the rates received on loans and investment securities and paid on deposits or other sources of funding as well as customers’ ability to repay loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have a material adverse effect on Fifth Third’s financial condition and results of operations. The impact of these changes may be magnified if Fifth Third does not effectively manage the relative sensitivity of its assets and liabilities to changes in market interest rates. Fluctuations in these areas may adversely affect 41 Fifth Third Bancorp 41 Fifth Third Bancorp 41 Fifth Third Bancorp Table of Contents Table of Contents Fifth Third, its customers and its shareholders. In response to the outbreak of the COVID-19 pandemic and its economic consequences, the FRB lowered its target for the federal funds rate to a range of 0% to 0.25%, but a recent pronounced rise in inflation has prompted the FRB to raise certain benchmark interest rates to combat it. As inflation increases and market interest rates rise, the value of Fifth Third’s investment securities, particularly those that have fixed rates or longer maturities, could decrease. Increasing rates would also increase debt service requirements for some of Fifth Third’s borrowers and may adversely affect those borrowers’ ability to pay as contractually obligated and could result in additional delinquencies or charge-offs. Further, the increase in market interest rates is likely to reduce Fifth Third’s loan origination volume, particularly refinance volume, and/or reduce its interest rate spread, which could have an adverse effect on Fifth Third’s profitability and results of operations. Conversely, a lowering in interest rates would likely further reduce the interest Fifth Third earns on loans and other earning assets. Fifth Third cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on Fifth Third’s activities and financial results.

In today’s digital world, more and more of Fifth Third’s business is conducted primarily via digital and mobile technology and information management systems. This includes the use of cloud computing, digital applications and third-party providers that host and store sensitive employee and customer information. Failures, interruptions of service or breaches in the security of these environments occur across the financial services industry with some frequency, including at Fifth Third and its third-party providers. If an event of this nature occurred at Fifth Third or one of its third-party providers and such event proved to be material, this could result in disruptions to Fifth Third’s accounting, deposit, lending and other systems, and adversely affect its customer relationships. While Fifth Third heavily invests in information security, technical resiliency, business continuity and disaster recovery planning, and has policies and procedures designed to detect, limit, and prevent the impact of these possible events, there can be no assurance that any such failure, interruption or security breach will not occur or, if any does occur, that it can be remediated in such a way to eliminate the risk. There will always be efforts on the part of threat actors to breach information security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services, credit bureaus and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data, by both private individuals and foreign governments. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from remote and less regulated areas around the world, Fifth Third may be unable to proactively address these techniques or to implement adequate preventative measures. Despite Fifth Third’s efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, Fifth Third may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative 29 Fifth Third Bancorp 29 Fifth Third Bancorp 29 Fifth Third Bancorp Table of Contents Table of Contents consequences of the incident. Furthermore, financial services companies are regularly the target of cyber-attacks such as distributed denial of service, social engineering and ransomware attacks. The unintentional or willful acts or omissions of employees also remains the primary avenue through which threat actors attempt to gain access to company networks, information systems, data and credentials. An additional risk is the use of third- and fourth-party providers to host critical data and platforms for Fifth Third, or in some cases provide IT services to Fifth Third domestically and internationally. Fifth Third must make investments in its ability to oversee third- and fourth-party providers and its failure to do so could result in customer losses, operational issues, litigation, regulatory actions and reputational loss. Industry trends are moving more to cloud providers, Software as a Service partners and hosted platforms that traditionally resided inside Fifth Third’s firewall and data centers. These additional risks are further heightened through the increasing use of near real-time money movement solutions such as Zelle, and increase the difficulty to detect, prevent and recover fraudulent transactions. These additional risks are increasing the costs of Fifth Third’s investment in technology and cybersecurity and require further investment in cyber-related and data loss event insurance which Fifth Third has in place. Though Fifth Third has insurance against some cybersecurity risks and attacks, it may not be sufficient to offset the impact of a material loss event. Future investment in these areas could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations. If personal, confidential or proprietary information of customers or clients in the Bancorp’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, the Bancorp could suffer significant regulatory consequences, reputational damage and financial loss.

In today’s digital world, more and more of Fifth Third’s business is conducted primarily via digital and mobile technology and information management systems. This includes the use of cloud computing, digital applications and third-party providers that host and store sensitive employee and customer information. Failures, interruptions of service or breaches in the security of these environments occur across the financial services industry with some frequency and, if a material event of this nature occurred at Fifth Third or one of its third-party providers, this could result in disruptions to Fifth Third’s accounting, deposit, lending and other systems, and adversely affect its customer relationships. While Fifth Third heavily invests in information security, technical resiliency, business continuity and disaster recovery planning, and has policies and procedures designed to detect, limit, and prevent the impact of these possible events, there can be no assurance that any such failure, interruption or security breach will not occur or, if any does occur, that it can be remediated in such a way to eliminate the risk. There will always be efforts on the part of threat actors to breach information security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services, credit bureaus and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data, by both private individuals and foreign governments. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from less regulated and remote areas around the world, Fifth Third may be unable to proactively address these techniques or to implement adequate preventative measures. Despite Fifth Third’s efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cyber security incident and the extent, amount and type of information compromised. During the course of an investigation, Fifth Third may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Furthermore, financial services companies are regularly the target of cyber-attacks such as distributed denial of service attacks and ransomware attacks. The unintentional or willful acts or omissions of employees also remains the primary avenue through which threat actors attempt to gain access to company networks, information systems and data. An emerging risk is the use of third- and fourth-party providers to host critical data and platforms for Fifth Third, or in some cases provide IT services to Fifth Third domestically and internationally. Fifth Third must make investments in its ability to oversee third- and fourth-party 34 Fifth Third Bancorp 34 Fifth Third Bancorp 34 Fifth Third Bancorp Table of Contents Table of Contents providers and its failure to do so could result in customer losses, operational issues, litigation, regulatory actions and reputational loss. Industry trends are moving more to cloud providers, Software as a Service partners and hosted platforms that traditionally resided inside Fifth Third’s firewall and data centers. These emerging risks are further heightened through the increasing use of near real-time money movement solutions such as Zelle, and increase the difficulty to detect, prevent and recover fraudulent transactions. These emerging risks are increasing the costs of Fifth Third’s investment in technology and cyber security and require further investment in cyber-related and data loss event insurance which Fifth Third has in place. Though Fifth Third has insurance against some cyber security risks and attacks, it may not be sufficient to offset the impact of a material loss event. Future investment in these areas could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations. If personal, confidential or proprietary information of customers or clients in the Bancorp’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, the Bancorp could suffer significant regulatory consequences, reputational damage and financial loss.

Fifth Third has exposure to counterparties in the financial services industry and other industries and routinely executes transactions with such counterparties, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. Many of Fifth Third’s transactions with other financial institutions expose Fifth Third to credit risk in the event of default of a counterparty or client. In addition, Fifth Third’s credit risk may be affected when the collateral it holds cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure. The commercial soundness of many financial institutions may be closely interrelated as a result of credit, trading, clearing or other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses or defaults by other institutions. This is sometimes referred to as “systemic risk” and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms and exchanges, with which the Bancorp interacts on a daily basis, and therefore could adversely affect Fifth Third. 27 Fifth Third Bancorp 27 Fifth Third Bancorp 27 Fifth Third Bancorp Table of Contents Table of Contents

Fifth Third has exposure to counterparties in the financial services industry and other industries and routinely executes transactions with such counterparties, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. Many of Fifth Third’s transactions with other financial institutions expose Fifth Third to credit risk in the event of default of a counterparty or client. In addition, Fifth Third’s credit risk may be affected when the collateral it holds cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure. The commercial soundness of many financial institutions may be closely interrelated as a result of credit, trading, clearing or other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses or defaults by other institutions. This is sometimes referred to as “systemic risk” and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms and exchanges, with which the Bancorp interacts on a daily basis, and therefore could adversely affect Fifth Third.

The FDIC maintains a Deposit Insurance Fund (“DIF”) to protect insured depositors in the event of bank failures. The DIF is funded by fees assessed on insured depository institutions including the Bank. Future deposit premiums paid by the Bank depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. As of June 30, 2020, the DIF reserve ratio fell to 1.30%, below the statutory minimum of 1.35%. In order to restore the DIF to its statutorily mandated minimums, the FDIC significantly increased deposit insurance premium rates, including the Bank’s, resulting in increased expenses. The revised assessment rate schedules became effective January 1, 2023, and are applicable to the first quarterly assessment period of 2023. Additionally, on November 16, 2023, the FDIC finalized a special assessment to recover the loss to the DIF caused by the bank failures that occurred in 2023 to be collected at an annual rate of approximately 13.4 basis points for an anticipated total of eight quarterly assessment periods, beginning the first quarterly assessment period of 2024. The FDIC may further increase the assessment rates or impose additional special assessments in the future, which may require the Bank to pay significantly higher FDIC premiums.

The FDIC maintains a Deposit Insurance Fund (“DIF”) to protect insured depositors in the event of bank failures. The DIF is funded by fees assessed on insured depository institutions including the Bank. Future deposit premiums paid by the Bank depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. The Bank may be required to pay significantly higher FDIC premiums if market developments change such that the DIF balance is reduced or the FDIC changes its rules to require higher premiums.