Fifth Third Bancorp: 10-K Risk Factor Changes

Global financial markets, including the U.S., face political and economic uncertainties (such as recent budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit or a prolonged government shutdown) that may delay investment and hamper economic activity. International events such as trade disputes, separatist movements, leadership changes and political and military conflicts could adversely affect global financial activity and markets and could negatively affect the U.S. economy. The impact of widespread health emergencies may also adversely impact global markets and Fifth Third’s operations. If its borrowers are adversely affected due to a widespread health emergency that impacts Fifth Third employees, vendors or economic growth generally, Fifth Third’s results of operations and financial condition could be adversely affected. Worldwide financial markets have recently experienced periods of extraordinary disruption and volatility, which have been driven by geopolitical events that have resulted in heightened credit risk, reduced valuation of investments, decreased economic activity, heightened risk of cyber-attacks and inflation. Changes in trade policies by the U.S. or other countries, such as tariffs or retaliatory tariffs, may cause inflation which could impact the prices of products sold by the Bancorp’s borrowers and have the potential to reduce demand for their products impacting their profitability and making it difficult for its borrowers to repay their loans. Moreover, many companies have experienced reduced liquidity and uncertainty as to their ability to raise capital during such periods of market disruption and volatility. Additionally, in recent years, the FRB and other major central banks have removed or reduced monetary accommodation and raised interest rates (although offset by recent rate reductions), increasing the risk of recession and may also negatively impact asset values and credit spreads that were impacted by extraordinary monetary stimulus. These potential negative effects on financial markets and economic activity could lead to reduced revenues, increased costs, increased credit risks and volatile markets, could adversely impact Fifth Third’s ability to raise liquidity via money and capital markets and could negatively impact Fifth Third’s business, financial condition and results of operations. In the event that these conditions recur or result in a prolonged economic downturn, Fifth Third’s financial position, results of operations and/or liquidity could be materially and adversely affected. These market conditions may affect the Bancorp’s ability to access debt and equity capital markets. In addition, as a result of recent financial and political events, Fifth Third may face increased regulation.

Global financial markets, including the U.S., face political and economic uncertainties (such as recent budget deficit concerns and political conflict over legislation to raise the U.S. government’s debt limit) that may delay investment and hamper economic activity. International events such as trade disputes, separatist movements, leadership changes and political and military conflicts (such as the ongoing military tension between Russia and Ukraine and the conflict in Israel and Gaza) could adversely affect global financial activity and markets and could negatively affect the U.S. economy. Worldwide financial markets have recently experienced periods of extraordinary disruption and volatility, which have been driven by geopolitical events that have resulted in heightened credit risk, reduced valuation of investments, decreased economic activity, heightened risk of cyber-attacks and inflation. Changes in trade policies by the U.S. or other countries, such as tariffs or retaliatory tariffs, may cause inflation which could impact the prices of products sold by the Bancorp’s borrowers and have the potential to reduce demand for their products impacting their profitability and making it difficult for its borrowers to repay their loans. Moreover, many companies have experienced reduced liquidity and uncertainty as to their ability to raise capital during such periods of market disruption and volatility. Additionally, in recent years, the FRB and other major central banks have removed or reduced monetary accommodation and raised interest rates (although offset by recent rate reductions), increasing the risk of recession and may also negatively impact asset values and credit spreads that were impacted by extraordinary monetary stimulus. These potential negative effects on financial markets and economic activity could lead to reduced revenues, increased costs, increased credit risks and volatile markets, could adversely impact Fifth Third’s ability to raise liquidity via money and capital markets and could negatively impact Fifth Third’s businesses, results of operations and financial condition. In the event that these conditions recur or result in a prolonged economic downturn, Fifth Third’s results of operations, financial position and/or liquidity could be materially and adversely affected. These market conditions may affect the Bancorp’s ability to access debt and equity capital markets. In addition, as a result of recent financial and political events, Fifth Third may face increased regulation.

The accounting standard setters, including the FASB, the SEC and other regulatory agencies, periodically change the financial accounting and reporting standards that govern the preparation of Fifth Third’s consolidated financial statements. These changes can be hard to predict and can materially impact how Fifth Third records and reports its financial condition and results of operations. In some cases, Fifth Third could be required to apply a new or revised standard retroactively, which would result in the recasting of Fifth Third’s prior period financial statements.

The accounting standard setters, including the FASB, the SEC and other regulatory agencies, periodically change the financial accounting and reporting standards that govern the preparation of Fifth Third’s consolidated financial statements. These changes can be hard to predict and can materially impact how Fifth Third records and reports its financial condition and results of operations. In some cases, Fifth Third could be required to apply a new or revised standard retroactively, which would result in the recasting of Fifth Third’s prior period financial statements.

Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions and their holding companies, the FRB, the FDIC, the CFPB and the OCC have the authority to compel or restrict certain actions by the Bancorp and the Bank. The Bancorp and the Bank are subject to such supervisory authority and, more generally, must, in certain instances, obtain prior regulatory approval before engaging in certain activities or corporate decisions. There can be no assurance that such approvals, if required, would be obtained or granted in a timely manner. Failure to receive any such approval, if required, could limit or impair the Bancorp’s operations, restrict its growth, ability to compete, innovate or participate in industry consolidation and/or affect its dividend policy. Such actions and activities that may be subject to prior approval include, but are not limited to, increasing dividends or other capital distributions by the Bancorp or the Bank, entering into a merger or acquisition transaction, acquiring or establishing new branches and entering into certain new businesses. Fifth Third and other financial institutions are highly regulated and subject to extensive oversight, supervision and examination by regulators and self-regulatory entities. In this regard, government authorities, including the bank regulatory agencies and law enforcement, may pursue enforcement actions with respect to compliance and other legal matters involving financial activities, which heightens the risks associated with actual and perceived compliance failures and may also adversely affect Fifth Third’s ability to enter into certain transactions or engage in certain activities, or obtain necessary regulatory approvals in connection therewith. Government enforcement authority includes the ability to: assess significant civil or criminal monetary penalties, fines or restitution; issue cease and desist or removal orders; and initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. In some cases, regulatory agencies may take supervisory actions that may not be publicly disclosed, which could restrict or limit Fifth Third. Finally, as part of Fifth Third’s regular examination process, the Bancorp and the Bank’s respective regulators may advise it and its banking subsidiary to operate under various restrictions as a prudential matter. Such supervisory actions or restrictions, if and in whatever manner imposed, could negatively affect Fifth Third’s ability to engage in new activities and certain transactions, as well as have a material adverse effect on Fifth Third’s business and results of operations and may not be publicly disclosed.

Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions and their holding companies, the FRB, the FDIC, the CFPB and the OCC have the authority to compel or restrict certain actions by the Bancorp and the Bank. The Bancorp and the Bank are subject to such supervisory authority and, more generally, must, in certain instances, obtain prior regulatory approval before engaging in certain activities or corporate decisions. There can be no assurance that such approvals, if required, would be forthcoming or that such approvals would be granted in a timely manner. Failure to receive any such approval, if required, could limit or impair the Bancorp’s operations, restrict its growth, ability to compete, innovate or participate in industry consolidation and/or affect its dividend policy. Such actions and activities that may be subject to prior approval include, but are not limited to, increasing dividends or other capital distributions by the Bancorp or the Bank, entering into a merger or acquisition transaction, acquiring or establishing new branches and entering into certain new businesses. Failure by the Bancorp or the Bank to meet the applicable eligibility requirements for FHC status (including capital and management requirements and that the Bank maintain at least a “Satisfactory” CRA rating) may result in restrictions on certain activities of the Bancorp, including the commencement of new activities and mergers with or acquisitions of other financial institutions and could ultimately result in the loss of FHC status. Fifth Third and other financial institutions are highly regulated and subject to extensive oversight, supervision and examination by regulators, including the FRB, OCC, FDIC, CFPB, SEC, CFTC, FINRA, the National Futures Association and other state, federal and self-regulatory entities. Fifth Third is also subject to certain regulatory requirements as a result of its banking activity including with respect to stress testing, liquidity and capital levels, asset quality, provisioning, AML/BSA, fair lending, consumer compliance, protection of customer information and other prudential matters and efforts to ensure that financial institutions take steps to improve their risk management and prevent future crises. For more information, refer to Regulation and Supervision—Regulatory Regime for Derivatives in Item 1 of this Annual Report on Form 10-K. In this regard, government authorities, including the bank regulatory agencies and law enforcement, are also pursuing aggressive enforcement actions with respect to compliance and other legal matters involving financial activities, which heightens the risks associated with actual and perceived compliance failures and may also adversely affect Fifth Third’s ability to enter into certain transactions or engage in certain activities, or obtain necessary regulatory approvals in connection therewith. The government enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. In some cases, regulatory agencies may take supervisory actions that may not be publicly disclosed, which restrict or limit a financial institution. Finally, as part of Fifth Third’s regular examination process, the Bancorp and the Bank’s respective regulators may advise it and its banking subsidiary to operate under various restrictions as a prudential matter. Such supervisory actions or restrictions, if and in whatever manner imposed, could negatively affect Fifth Third’s ability to engage in new activities and certain transactions, as well as have a material adverse effect on Fifth Third’s business and results of operations and may not be publicly disclosed. 32 Fifth Third Bancorp 32 Fifth Third Bancorp 32 Fifth Third Bancorp Table of Contents Table of Contents

Fifth Third has experienced, and may experience again in the future, losses incurred due to customer or employee fraud, theft or physical violence. Additionally, physical violence may negatively affect Fifth Third’s key personnel, facilities or systems. These losses may be material and negatively affect Fifth Third’s financial condition, results of operations or prospects or lead to significant reputational risks and other effects. The industry fraud threat continues to evolve, including but not limited to strategies such as card fraud, check fraud, electronic fraud, wire fraud, social engineering, the use of AI for impersonation and other schemes, malware and phishing attacks for identity theft and account takeover. Fifth Third continues to invest in fraud prevention in the forms of people and systems designed to prevent, detect and mitigate the customer and financial impacts.

Fifth Third has experienced, and may experience again in the future, losses incurred due to customer or employee fraud, theft or physical violence. Additionally, physical violence may negatively affect Fifth Third’s key personnel, facilities or systems. These losses may be material and negatively affect Fifth Third’s results of operations, financial condition or prospects. These losses could also lead to significant reputational risks and other effects. The industry fraud threat continues to evolve, including but not limited to, card fraud, check fraud, electronic fraud, wire fraud, social engineering and phishing attacks for identity theft and account takeover. Nationally, reported incidents of fraud and other financial crimes have increased. Increased use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and operations, coupled with the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others increases Fifth Third’s security risks. Fifth Third continues to invest in fraud prevention in the forms of people and systems designed to prevent, detect and mitigate the customer and financial impacts.

Fifth Third’s income and cash flows depend to a great extent on the difference between the interest rates earned on interest-earning assets such as loans and investment securities and the interest rates paid on interest-bearing liabilities such as deposits and borrowings. These rates are highly sensitive to many factors that are beyond Fifth Third’s control, including general economic conditions in the U.S. or abroad and the policies of various governmental and regulatory agencies (in particular, the FRB). Changes in monetary policy, including changes in interest rates and inflation, could influence the origination of loans, the prepayment speed of loans, the purchase of investments, the generation of deposits and the rates received on loans and investment securities and paid on deposits or other sources of funding as well as customers’ 34 Fifth Third Bancorp 34 Fifth Third Bancorp 34 Fifth Third Bancorp Table of Contents Table of Contents ability to repay loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have a material adverse effect on Fifth Third’s financial condition and results of operations. The impact of these changes may be magnified if Fifth Third does not effectively manage the relative sensitivity of its assets and liabilities to changes in market interest rates. Fluctuations in these areas may adversely affect Fifth Third, its customers and its shareholders. Fifth Third cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on Fifth Third’s activities and financial results.

Fifth Third’s income and cash flows depend to a great extent on the difference between the interest rates earned on interest-earning assets such as loans and investment securities and the interest rates paid on interest-bearing liabilities such as deposits and borrowings. These rates are highly sensitive to many factors that are beyond Fifth Third’s control, including general economic conditions in the U.S. or abroad and the policies of various governmental and regulatory agencies (in particular, the FRB). Changes in monetary policy, including changes in interest rates and inflation, could influence the origination of loans, the prepayment speed of loans, the purchase of investments, the generation of deposits and the rates received on loans and investment securities and paid on deposits or other sources of funding as well as customers’ ability to repay loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower’s products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have a material adverse effect on Fifth Third’s financial condition and results of operations. The impact of these changes may be magnified if Fifth Third does not effectively manage the relative sensitivity of its assets and liabilities to changes in market interest rates. Fluctuations in these areas may adversely affect Fifth Third, its customers and its shareholders. Throughout 2022 and 2023, the Federal Reserve raised the federal funds rate to between 5.25% and 5.5% in an effort to curb inflation. Although the FRB reduced benchmark rates in the second half of 2024, they remain higher than in previous years, and the inflationary outlook in the U.S. is currently uncertain. To the extent inflation increases and market interest rates rise, the value of Fifth Third’s investment securities, particularly those that have fixed rates or longer maturities, could decrease. Persistent or increasing inflation could lead to the FRB reversing recent reductions in interest rates. Increasing rates would also increase debt service requirements for some of Fifth Third’s borrowers and may adversely affect those borrowers’ ability to pay as contractually obligated and could result in additional delinquencies or charge-offs. Further, any increase in market interest rates is likely to reduce Fifth Third’s loan origination volume, particularly refinance volume, and/or reduce its interest rate spread, which could have an adverse effect on Fifth Third’s profitability and results of operations. Conversely, a lowering in interest rates would likely further reduce the interest Fifth Third earns on loans and other earning assets. Fifth Third cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on Fifth Third’s activities and financial results.

Fifth Third’s ability to deliver strong financial performance and returns on investment to shareholders will depend in part on its ability to expand the scope of available financial services to meet the needs and demands of its customers. In addition to the challenge of competing against other banks in attracting and retaining customers for traditional banking services, Fifth Third’s competitors also include securities dealers, brokers, mortgage bankers, investment advisors, specialty finance, private credit, financial technology and insurance companies as well as large retailers who seek to offer one-stop financial services in addition to other products and services desired by consumers that may include services that banks have not been able or allowed to offer to their customers in the past or may not be currently able or allowed to offer. These other firms may be significantly different than Fifth Third. For example, they may be larger and have access to customers and financial resources that are beyond Fifth Third’s capability or they may be non-regulated allowing them to be more agile. Fifth Third competes with these firms with respect to capital, access to capital, revenue generation, products, services, transaction execution, innovation, 35 Fifth Third Bancorp 35 Fifth Third Bancorp 35 Fifth Third Bancorp Table of Contents Table of Contents reputation, talent and price. For example, as a result of the GENIUS Act, passed in 2025 to provide a regulatory framework for stablecoins in the U.S., increased competition may emerge from issuers of stablecoins and providers of related technology. Fifth Third may make strategic investments and may expand an existing line of business or enter into new lines of business to remain competitive. If Fifth Third’s chosen strategies are not successful or effective, Fifth Third’s business and results may suffer. Additionally, these strategies may bring with them unforeseeable or unforeseen risks and may not generate the expected results or returns, which could adversely affect Fifth Third’s results of operations or future growth prospects and cause Fifth Third to fail to meet its stated goals and expectations.

Fifth Third’s ability to deliver strong financial performance and returns on investment to shareholders will depend in part on its ability to expand the scope of available financial services to meet the needs and demands of its customers. In addition to the challenge of competing against other banks in attracting and retaining customers for traditional banking services, Fifth Third’s competitors also include securities dealers, brokers, mortgage bankers, investment advisors and specialty finance, telecommunications, technology and insurance companies as well as large retailers who seek to offer one-stop financial services in addition to other products and services desired by consumers that may include services that banks have not been able or allowed to offer to their customers in the past or may not be currently able or allowed to offer. Many of these other firms may be significantly larger than Fifth Third and may have access to customers and financial resources that are beyond Fifth Third’s capability. Fifth Third competes with these firms with respect to capital, access to capital, revenue generation, products, services, transaction execution, innovation, reputation, talent and price. This increasingly competitive environment is primarily a result of changes in customer preferences, regulation, changes in technology and product delivery systems, as well as the accelerating pace of consolidation among financial service providers. Rapidly changing technology and consumer preferences may require Fifth Third to effectively implement new technology-driven products and services in order to compete and meet customer demands. Fifth Third may not be able to do so or be successful in marketing these products and services to its customers. As a result, Fifth Third’s ability to effectively compete to retain or acquire new business may be impaired, and its business, financial condition or results of operations, may be adversely affected. Fifth Third may make strategic investments and may expand an existing line of business or enter into new lines of business to remain competitive. If Fifth Third’s chosen strategies are not appropriate to allow Fifth Third to effectively compete or Fifth Third does not execute them in an appropriate or timely manner, Fifth Third’s business and results may suffer. Additionally, these strategies, products and lines of business may bring with them unforeseeable or unforeseen risks and may not generate the expected results or returns, which could adversely affect Fifth Third’s results of operations or future growth prospects and cause Fifth Third to fail to meet its stated goals and expectations.

When Fifth Third lends money or commits to lend money, the Bancorp incurs credit risk, or the risk of loss if borrowers do not repay their loans, leases, credit cards, derivative obligations or other credit obligations. The performance of these credit portfolios significantly affects the Bancorp’s financial results and condition, including the level of credit losses and reserves for credit losses. Fifth Third’s credit risk and credit losses can increase if its loans are concentrated among individual borrowers, borrowers engaged in the same or similar activities, industries or geographies, or to borrowers who as a group may be uniquely or disproportionately affected by economic or market conditions. Refer to the Credit Risk Management subsection of the Risk Management section in Item 7 of this Annual Report for more information on specific concentrations. Fifth Third reserves for expected credit losses by establishing an allowance for credit losses through a charge to earnings. The amount of this allowance is based on Fifth Third’s assessment of credit losses expected to be incurred in the credit portfolios, including unfunded commitments, and requires difficult, subjective and complex judgments about the environment, including analysis of economic or market conditions that may impair the ability of borrowers to repay their loans. Fifth Third may underestimate the credit losses expected to be incurred in its portfolios and have credit losses in excess of the amount reserved. Alternatively, Fifth Third may increase the reserve because of changing economic or market conditions, including inflation, interest rate fluctuations, higher unemployment, or other factors such as changing protections in credit agreements or changes in borrowers’ behavior. Fifth Third believes that both the ALLL and reserve for unfunded commitments are adequate to cover expected losses at December 31, 2025. However there is no assurance that they will be sufficient to cover all potential future credit losses associated with exposures existing at December 31, 2025, especially if economic conditions decline.

When Fifth Third lends money or commits to lend money, the Bancorp incurs credit risk, or the risk of loss if borrowers do not repay their loans, leases, credit cards, derivative obligations or other credit obligations. The performance of these credit portfolios significantly affects the Bancorp’s financial results and condition. If the current economic environment were to deteriorate, more customers may have difficulty in repaying their credit obligations which could result in a higher level of credit losses and reserves for credit losses. Fifth Third reserves for credit losses by establishing reserves through a charge to earnings. The amount of these reserves is based on Fifth Third’s assessment of credit losses expected to be incurred in the credit portfolios, including unfunded credit commitments. The process for determining the amount of the ALLL and the reserve for unfunded commitments is critical to Fifth Third’s financial results and condition. Such determination requires difficult, subjective and complex judgments about the environment, including analysis of economic or market conditions that may impair the ability of borrowers to repay their loans. Fifth Third may underestimate the credit losses expected to be incurred in its portfolios and have credit losses in excess of the amount reserved. Alternatively, Fifth Third may increase the reserve because of changing economic or market conditions, including inflation, interest rate fluctuations, higher unemployment, or other factors such as changing protections in credit agreements or changes in borrowers’ behavior. As an example, borrowers may “strategically default,” or discontinue making payments on their real estate-secured loans if the value of the real estate is less than what they owe, even if they are still financially able to make the payments. Fifth Third believes that both the ALLL and the reserve for unfunded commitments are adequate to cover expected losses at December 31, 2024. However, there is no assurance that they will be sufficient to cover future credit losses associated with exposures existing at December 31, 2024, especially if economic conditions decline. In the event of significant deterioration in economic or market conditions, Fifth Third may be required to increase reserves in future periods, which would reduce earnings.

Some Fifth Third customers rely on additional sources of capital from outside the Bancorp. If public or private capital markets are disrupted or unavailable to these borrowers such that they cannot obtain funds for refinancing, those borrowers may experience a shortfall that would leave them unable to honor short-term and/or long-term obligations to the Bancorp.

Some Fifth Third customers rely on additional sources of capital from outside the Bancorp. If capital markets are disrupted or unavailable to these borrowers such that they cannot obtain funds for refinancing, those borrowers may experience a shortfall that would leave them unable to honor short-term and/or long-term obligations to the Bancorp.

Government regulation and legislation subject Fifth Third to restrictions, oversight and/or costs that may have an impact on Fifth Third’s business, financial condition, results of operations or the price of its common stock. Fifth Third is subject to extensive federal and state regulation, supervision and legislation that govern almost all aspects of its operations and limit the businesses in which Fifth Third may engage. This includes many regulations related to Fifth Third’s banking, investment banking, securities underwriting, market making, investment management and retail and institutional brokerage services businesses offered through the Bancorp’s subsidiaries. These laws and regulations may change from time to time and are primarily intended for the protection of consumers, borrowers and depositors and are not designed to protect security-holders. Compliance with these laws and regulations has resulted in and will continue to result in additional costs, which could be significant, and may have a material and adverse effect on Fifth Third’s results of operations. In addition, if Fifth Third does not comply with applicable legislation and regulations, Fifth Third may be subject to litigation, fines, penalties or judgments, or material regulatory restrictions on its businesses, which could adversely affect operations and, in turn, financial results, or that materially adversely affect its shareholders. Future changes in laws or regulations or their interpretations or enforcement may also be materially adverse to Fifth Third and its shareholders or may require Fifth Third to expend significant time and resources to comply with such requirements. Similarly, the impact of domestic and international events related to financial crime such as fraud, money laundering and economic sanctions will continue to be an area of constant change, risk and regulatory focus which pose ongoing regulatory, compliance, operational and financial risks. Fifth Third cannot predict whether or what pending or future legislation will be adopted or the impact of any such new legislation on Fifth Third. Changes in regulation and supervisory and enforcement focus could affect Fifth Third in a substantial way and could have an adverse 32 Fifth Third Bancorp 32 Fifth Third Bancorp 32 Fifth Third Bancorp Table of Contents Table of Contents effect on its business, financial condition and results of operations. Additionally, legislation or regulatory reform could affect the behaviors of third parties that Fifth Third deals within the course of business, such as rating agencies, insurance companies and investors. Bank failures may create market volatility and regulatory uncertainty which could have a material adverse effect on Fifth Third’s business and financial condition. In addition, changes in laws or regulations that affect Fifth Third’s customers and business partners could negatively affect Fifth Third’s revenues and expenses. Certain changes in laws or regulations such as tax law reforms that impose limitations on the deductibility of interest may decrease the demand for Fifth Third’s products or services and could negatively affect its financial condition and results of operations. Heightened standards under new laws or regulations may result in increased obligations and compliance costs, may result in supervisory or enforcement action, and may factor into Fifth Third’s ability to expand services and/or engage in new activities. Other changes in laws or regulations could cause Fifth Third’s third-party service providers and other vendors to increase prices and negatively affect Fifth Third’s expenses and financial results.

Government regulation and legislation subject Fifth Third and other financial institutions to restrictions, oversight and/or costs that may have an impact on Fifth Third’s business, financial condition, results of operations or the price of its common stock. Fifth Third is subject to extensive federal and state regulation, supervision and legislation that govern almost all aspects of its operations and limit the businesses in which Fifth Third may engage. These laws and regulations may change from time to time and are primarily intended for the protection of consumers, borrowers and depositors and are not designed to protect security-holders. In the past decade, the scope of the laws and regulations and the intensity of the supervision to which Fifth Third is subject increased in response to the 2008-2009 financial crisis as well as other factors such as technological and market changes. Compliance with these laws and regulations has resulted in and will continue to result in additional costs, which could be significant, and may have a material and adverse effect on Fifth Third’s results of operations. In addition, if Fifth Third does not appropriately comply with current or future legislation and regulations, especially those that apply to its consumer operations, which has been an area of heightened focus, Fifth Third may be subject to fines, penalties or judgments, or material regulatory restrictions on its businesses, which could adversely affect operations and, in turn, financial results. Additionally, actions by regulatory agencies or significant litigation against Fifth Third could cause it to devote significant time and resources to defending itself and may lead to penalties that materially affect Fifth Third and its shareholders. Future changes in laws or regulations (including tax laws and regulations such as the Inflation Reduction Act) or their interpretations or enforcement may also be materially adverse to Fifth Third and its shareholders or may require Fifth Third to expend significant time and resources to comply with such requirements. In addition, as climate change issues become more prevalent, the U.S. and foreign governments are beginning to respond to these issues. The evolving federal and state government focus on climate change may result in new environmental regulations, including disclosure requirements from other jurisdictions in which the Bank operates that could result in additional compliance costs. Similarly, the impact of domestic and international events related to financial crime such as fraud, money laundering, and economic sanctions will continue to be an area of constant change, risk, and regulatory focus which pose ongoing regulatory, compliance, operational and financial risks. It is anticipated that the Trump administration will promulgate a number of executive orders and propose legislation that could directly impact the regulation of the financial services industry, many of which may mark a departure from the Biden administration’s regulatory agenda that has included a heightened focus on the risks arising from climate change, fair lending, consumer protection, Bank Secrecy Act and anti-money laundering requirements, topics related to social equity, executive compensation, and increased capital and liquidity, as well as limits on share buybacks and dividends. It is uncertain if the implementation of any of these policies would impact Fifth Third, and if so, what the impact would be. We expect the Trump administration will seek to implement a regulatory reform agenda that is significantly different than that of the Biden administration, impacting the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies. It is not possible at this time to determine whether changes in the administration may change the regulatory focus and/or implementation of any regulations, policies or reforms. 31 Fifth Third Bancorp 31 Fifth Third Bancorp 31 Fifth Third Bancorp Table of Contents Table of Contents Fifth Third cannot predict whether any pending or future legislation will be adopted or the substance and impact of any such new legislation on Fifth Third. Changes in regulation and supervisory and enforcement focus could affect Fifth Third in a substantial way and could have an adverse effect on its business, financial condition and results of operations. Additionally, legislation or regulatory reform could affect the behaviors of third parties that Fifth Third deals with in the course of business, such as rating agencies, insurance companies and investors. In addition, changes in laws or regulations that affect Fifth Third’s customers and business partners could negatively affect Fifth Third’s revenues and expenses. Certain changes in laws such as tax law reforms that impose limitations on the deductibility of interest may decrease the demand for Fifth Third’s products or services and could negatively affect its revenues and results of operations. Heightened standards under proposed and recently finalized laws or regulations, or regulations soon to enter into force whose enforcement is yet to begin (such as, for example, capital and liquidity rules, or heightened Community Reinvestment Act standards), may result in increased obligations and compliance costs, may result in supervisory or enforcement action and may factor into Fifth Third’s ability to expand services and/or engage in new actions. Other changes in laws or regulations could cause Fifth Third’s third-party service providers and other vendors to increase the prices they charge to Fifth Third and negatively affect Fifth Third’s expenses and financial results.

Fifth Third earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue Fifth Third receives from loan originations. At the same time, revenue from mortgage servicing rights (“MSRs”) can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, also with some offsetting revenue effect. Even though the origination of mortgage loans can act as a natural hedge, the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of residential MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would accrue over time. It is also possible that even if interest rates were to fall, mortgage originations may also fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates. Fifth Third typically uses derivatives and other instruments to hedge its mortgage banking interest rate and price risks. Fifth Third generally does not hedge all of its risks and the fact that Fifth Third attempts to hedge any of the risks does not mean Fifth Third will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. Fifth Third may use hedging instruments tied to U.S. Treasury rates, SOFR or other benchmarks that may not perfectly correlate with the value or income being hedged. Fifth Third could incur significant losses from its hedging activities. There may be periods where Fifth Third elects not to use derivatives and other instruments to hedge mortgage banking interest rate and price risks. Market conditions can also affect Fifth Third’s contractual obligations related to residential mortgage loans sold to various parties, including government-sponsored enterprises and other financial institutions for investment or private-label securitization. If Fifth Third breaches contractual representations or warranties and does not remedy the breach within a specified period, it may be required to repurchase loans, indemnify the securitization trust, investor, or insurer, or reimburse them for credit losses. As a result, Fifth Third has established reserves for probable losses related to sold loans; however, if economic conditions or the housing market deteriorate, or if repurchase demands and Fifth Third’s success in appealing such requests differ from expectations, repurchase obligations and loss severity could increase, requiring material additions to reserves. There can be no assurance that reserves will be adequate or that losses will not have a material adverse effect on Fifth Third’s financial condition or results of operations.

Fifth Third earns revenue from the fees it receives for originating mortgage loans and for servicing mortgage loans. When rates rise, the demand for mortgage loans tends to fall, reducing the revenue Fifth Third receives from loan originations. At the same time, revenue from mortgage servicing rights (“MSRs”) can increase through increases in fair value. When rates fall, mortgage originations tend to increase and the value of MSRs tends to decline, also with some offsetting revenue effect. Even though the origination of mortgage loans can act as a “natural hedge,” the hedge is not perfect, either in amount or timing. For example, the negative effect on revenue from a decrease in the fair value of residential MSRs is immediate, but any offsetting revenue benefit from more originations and the MSRs relating to the new loans would accrue over time. It is also possible that even if interest rates were to fall, mortgage originations may also fall or any increase in mortgage originations may not be enough to offset the decrease in the MSRs value caused by the lower rates. Fifth Third typically uses derivatives and other instruments to hedge its mortgage banking interest rate and price risks. Fifth Third generally does not hedge all of its risks and the fact that Fifth Third attempts to hedge any of the risks does not mean Fifth Third will be successful. Hedging is a complex process, requiring sophisticated models and constant monitoring. Fifth Third may use hedging instruments tied to U.S. Treasury rates, SOFR or other benchmarks that may not perfectly correlate with the value or income being hedged. Fifth Third could incur significant losses from its hedging activities. There may be periods where Fifth Third elects not to use derivatives and other instruments to hedge mortgage banking interest rate and price risks.

There is continued focus, including from governmental organizations, regulators, investors, customers and other stakeholders, on environmental, social, governance and sustainability issues. Laws and regulations related to these issues continue to rapidly evolve. These laws and regulations may impose additional compliance or disclosure obligations on Fifth Third. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact Fifth Third’s reputation, ability to do business with certain partners, access to capital and its stock price. States throughout Fifth Third’s footprint have taken actions or proposed measures to limit the state’s ability to do business with financial institutions or other businesses identified as discriminating against certain industries or practices based on environmental or social criteria. Activist groups and state officials have targeted firms with public criticism and penalties either for engaging in, or not engaging in, certain environmental, social or governance practices or principles. Although Fifth Third has a defined risk-based approach for client selection, Fifth Third could be inherently exposed to reputational, financial and legal risk, and its ability to retain and attract customers and employees may be negatively impacted as a result of contrasting opinions about how a financial institution should address these issues.

There is continued focus, including from governmental organizations, regulators, investors, customers and other stakeholders, on environmental, social, governance and sustainability issues. Laws and regulations related to these issues continue to evolve. These laws and regulations may impose additional compliance or disclosure obligations on us. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact Fifth Third’s reputation, ability to do business with certain partners, access to capital and its stock price. Organizations that provide information to investors and shareholders on corporate governance and related matters have developed scores and ratings to evaluate companies on their approach to these matters, and unfavorable ratings of Fifth Third may lead to negative investor sentiment and negative publicity in traditional and social media, including based on the identity of those Fifth Third chooses to do business with and the public’s view of those customers. While Fifth Third has sustainability and corporate responsibility initiatives, there can be no assurance that regulators, customers, investors and employees will determine that these programs are sufficiently robust. Actual or perceived shortcomings with respect to these initiatives and reporting can impact Fifth Third’s ability to hire and retain employees, increase its customer base or attract and retain certain types of investors. Collecting, measuring, and reporting on this information and metrics can be costly, difficult and time consuming, is subject to evolving reporting standards and can present numerous operational, reputational, financial, legal and other risks, any of which could have a material impact, including on Fifth Third’s reputation and stock price. Inadequate processes to collect and review this information prior to disclosure could be subject to potential liability related to such information. Activists have historically targeted financial firms with public criticism for their relationships with clients that are engaged in certain industries (such as those which are carbon intensive), including businesses whose products are or are perceived to be harmful to health, the environment, the global climate or the social good. Activist criticism of Fifth Third’s relationships or due diligence practices with clients in sensitive industries could potentially engender dissatisfaction among stakeholders with how Fifth Third addresses environmental or social concerns through business activities or disclosures which could negatively affect its business or reputation. Conversely, states throughout the Bank’s footprint have taken actions or proposed measures to limit the state’s ability to do business with financial institutions or other businesses identified as discriminating against certain industries (such as those which are carbon intensive) or practices based on environmental or social criteria. Additionally, other activist groups and state officials have in the past targeted firms with public criticism and penalties for engaging in, or adhering to, certain environmental, social or governance practices or principles. Although Fifth Third has a defined risk-based approach for client selection, Fifth Third could be inherently exposed to reputational, financial and legal risk, and its ability to retain and attract customers and employees may be negatively impacted as a result of these contrasting arguments in how a financial institution should address these issues.

Fifth Third’s access to capital markets is a key component of its funding strategy and is influenced by ratings assigned by rating agencies to Fifth Third, certain of its subsidiaries and particular classes of securities they issue. These ratings also affect the interest rates that Fifth Third pays when issuing new debt securities. A downgrade to Fifth Third or its subsidiaries’ credit rating could limit its access to the capital markets, affect its ability to retain deposits, cause creditors and business counterparties to raise collateral requirements, increase its borrowing costs and reduce profitability. Additionally, downgrades may trigger obligations or create liabilities under the terms of Fifth Third’s existing arrangements that could increase costs, impair the marketability of affected securities, prompt further downgrades and otherwise have a negative effect on Fifth Third’s financial condition or results of operations. There can be no assurances that Fifth Third or its subsidiaries will retain any specific rating from any specific rating agency.

Fifth Third’s ability to access the capital markets is important to its overall funding profile. This access is affected by the ratings assigned by rating agencies to Fifth Third, certain of its subsidiaries and particular classes of securities they issue. The interest rates that Fifth Third pays 26 Fifth Third Bancorp 26 Fifth Third Bancorp 26 Fifth Third Bancorp Table of Contents Table of Contents on its securities are also influenced by, among other things, the credit ratings that it, its subsidiaries and/or its securities receive from recognized rating agencies. A downgrade to Fifth Third or its subsidiaries’ credit rating could affect its ability to access the capital markets, increase its borrowing costs and negatively impact its profitability. A ratings downgrade to Fifth Third, its subsidiaries or their securities could also create obligations or liabilities of Fifth Third under the terms of its outstanding securities that could increase Fifth Third’s costs or otherwise have a negative effect on its results of operations or financial condition. Additionally, a downgrade of the credit rating of any particular security issued by Fifth Third or its subsidiaries could negatively affect the ability of the holders of that security to sell the securities and the prices at which any such securities may be sold. Other rating agencies may also take actions to downgrade their ratings of the securities issued by Fifth Third or its subsidiaries. There can be no assurances that Fifth Third or its subsidiaries will retain any specific rating from any specific rating agency.

Fifth Third’s business is conducted primarily via digital and information technology systems. This includes the use of digital applications, cloud computing and third- and fourth-party providers that host and store customer, employee and operational information. Failures, service interruptions, breaches or attempted breaches in the security of these environments occur frequently across the financial services industry including at Fifth Third and its third- and fourth-party providers. If a material event of this nature occurred at Fifth Third or one of its third- or fourth-party providers, it could result in disruptions to Fifth Third’s accounting, deposit, lending and other systems, and adversely affect its customer relationships. Fifth Third invests in information security, technical resiliency, business continuity and disaster recovery planning, and has policies and procedures designed to detect, limit, and prevent the impact of these possible events, and requires its third-party service providers to maintain similar controls. Despite this, there can be no assurance that any cyber-attacks, security breaches or system failures or interruptions will not occur or, if any do occur, that it can be remediated in such a way to eliminate the risk. Financial institutions are the targets of frequent efforts to breach systems, including through denial of service attacks, social engineering such as phishing and smishing, placement of insider threats, and ransomware, among others. Moreover, because the techniques used to cause such security breaches change frequently, may not be recognized until launched against a target and may originate from remote and less regulated areas around the world, Fifth Third may be unable to proactively address these techniques or to implement adequate preventative measures. The increasing interdependence and complexity of financial institutions and infrastructure also means a disruption, compromise or failure that 29 Fifth Third Bancorp 29 Fifth Third Bancorp 29 Fifth Third Bancorp Table of Contents Table of Contents affects one segment of the financial services industry could also impact Fifth Third. The prospect that AI may be used to conduct attacks may make them more difficult to detect. Additionally, the growing sophistication of AI increases the risk of cyber-attacks. Despite Fifth Third’s efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period before being detected and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During an investigation, Fifth Third may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Additionally, Fifth Third uses third- and fourth-party providers to host data, products, services, systems or platforms for Fifth Third, or in some cases to provide services to Fifth Third domestically and internationally. Fifth Third has a third-party risk program to oversee third- and fourth-party providers. This does not eliminate all risk and its failure to do so could result in customer losses, operational issues, litigation, regulatory actions and reputational damage. Even with reasonable investment and diligence by Fifth Third, Fifth Third’s ability to prevent cyber-attacks, security breaches or system failures or interruptions impacting its third- and fourth-party service providers may be limited. Financial services industry trends demonstrate a shift towards the use of cloud providers, Software as a Service partners and hosted platforms rather than traditional software services that can be operated from within a company’s firewall and data centers. The risks relating to security and availability of Fifth Third’s systems are further heightened through the increasing use of near real-time money movement solutions such as Zelle, and increase the difficulty to detect, prevent and recover fraudulent transactions. While controls are robust, the speed and automation of these systems introduce a risk of erroneous transactions that could result in financial loss. These additional risks are increasing the costs of Fifth Third’s investment in technology and cybersecurity and require further investment in cyber-related and data loss event insurance which Fifth Third has in place. Though Fifth Third has insurance against some cybersecurity risks and attacks, it may not be sufficient to offset the impact of a material loss event; and, Fifth Third cannot guarantee that cybersecurity insurance policies will not deny coverage, or that existing insurance coverage will continue to be available on acceptable terms. Future investment in these areas could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations. Further, clients and customers use their own devices to utilize mobile banking and online services. Not all of Fifth Third’s clients, customers or counterparties have appropriate controls in place to protect information exchanged between them and Fifth Third. This may create new security risks and increase the likelihood of security incidents impacting customers’ information. Customers’ information may not always be protected by third-party applications or other third-party technology used in connection with such services. This can result and has resulted in fraud. A security breach impacting systems operated by or on behalf of Fifth Third, or the loss or corruption of confidential information such as customer data, business results, and transaction records could adversely impact Fifth Third in numerous material ways, including by requiring public notification about the incident, causing financial losses, impacting Fifth Third’s ability to provide timely and accurate financial information in compliance with legal and regulatory requirements, all of which could result in regulatory sanctions, litigation, reputational harm, monetary loss and the loss of customer confidence in Fifth Third. Additionally, security breaches involving the loss, mishandling, theft or corruption of customer or client information could result in adverse consequences including financial losses to Fifth Third's customers, litigation, regulatory sanctions, lost customers and revenue, increased costs and reputational harm. For more detail on Fifth Third’s cybersecurity governance structure and practices, see Item 1C of this Annual Report.

In today’s digital world, more and more of Fifth Third’s business is conducted primarily via digital and mobile technology and information management systems. This includes the use of cloud computing, digital applications and third-party providers that host and store sensitive employee and customer information. Failures, interruptions of service or breaches in the security of these environments occur across the financial services industry with some frequency, including at Fifth Third and its third-party providers. If an event of this nature occurred at Fifth Third or one of its third-party providers and such event proved to be material, this could result in disruptions to Fifth Third’s accounting, deposit, lending and other systems, and adversely affect its customer relationships. While Fifth Third heavily invests in information security, technical resiliency, business continuity and disaster recovery planning, and has policies and procedures designed to detect, limit, and prevent the impact of these possible events, there can be no assurance that any such failure, interruption or security breach will not occur or, if any does occur, that it can be remediated in such a way to eliminate the risk. There will always be efforts on the part of threat actors to breach information security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services, credit bureaus and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data, by both private individuals and foreign governments. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from remote and less regulated areas around the world, Fifth Third may be unable to 27 Fifth Third Bancorp 27 Fifth Third Bancorp 27 Fifth Third Bancorp Table of Contents Table of Contents proactively address these techniques or to implement adequate preventative measures. Threat actors, including nation state attackers, could also use artificial intelligence for malicious purposes, increasing the frequency, complexity and effectiveness of their attacks. Despite Fifth Third’s efforts to prevent a cyber-attack and monitoring of data flow inside and outside Fifth Third, due to the increasing sophistication of techniques used by attackers to conceal access to systems, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, Fifth Third may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Furthermore, financial services companies are regularly the target of cyber-attacks such as distributed denial of service, social engineering and ransomware attacks. The unintentional or willful acts or omissions of employees also remains the primary avenue through which threat actors attempt to gain access to company networks, information systems, data and credentials. An additional risk is the use of third- and fourth-party providers to host critical data and platforms for Fifth Third, or in some cases provide services to Fifth Third domestically and internationally. Fifth Third has a third-party risk program to oversee third- and fourth-party providers. This does not eliminate all risk and its failure to do so could result in customer losses, operational issues, litigation, regulatory actions and reputational damage. Industry trends demonstrate a shift towards the use of cloud providers, Software as a Service partners and hosted platforms rather than traditional software services that can be operated from within a company’s firewall and data centers, and the implementation and development of new and emerging technologies such as artificial intelligence. These additional risks are further heightened through the increasing use of near real-time money movement solutions such as Zelle, and increase the difficulty to detect, prevent and recover fraudulent transactions. These additional risks are increasing the costs of Fifth Third’s investment in technology and cybersecurity and require further investment in cyber-related and data loss event insurance which Fifth Third has in place. Though Fifth Third has insurance against some cybersecurity risks and attacks, it may not be sufficient to offset the impact of a material loss event. Future investment in these areas could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations. If personal, confidential or proprietary information of customers or clients in the Bancorp’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, the Bancorp could suffer significant regulatory consequences, reputational damage and financial loss.

Inherent uncertainties exist when identifying, assessing, acquiring or integrating the operations of another business or investment or relationship opportunity. Fifth Third may not be able to fully achieve its strategic objectives and planned operating efficiencies relevant to an acquisition or strategic relationship. In addition, the markets and industries in which Fifth Third and its potential acquisition and investment targets operate are highly competitive. Acquisition or investment targets may lose customers or otherwise perform poorly or unprofitably, or in the case of an acquired business or strategic relationship, cause Fifth Third to lose customers or perform poorly or unprofitably. Future acquisition and investment activities and efforts to monitor newly acquired businesses or reap the benefits of a new strategic relationship may require Fifth Third to devote substantial time and resources and may cause these acquisitions, investments and relationships to be unprofitable or cause Fifth Third to be unable to pursue other business opportunities. Fifth Third may also not realize the expected benefits of the acquisition due to lower financial results pertaining to the acquired entity or assets. Additionally, acquired companies or businesses may increase Fifth Third’s risk of regulatory action or restrictions related to the operations of the acquired business.

Inherent uncertainties exist when assessing, acquiring or integrating the operations of another business or investment or relationship opportunity. Fifth Third may not be able to fully achieve its strategic objectives and planned operating efficiencies relevant to an acquisition or strategic relationship. In addition, the markets and industries in which Fifth Third and its potential acquisition and investment targets operate are highly competitive. Acquisition or investment targets may lose customers or otherwise perform poorly or unprofitably, or in the case of an acquired business or strategic relationship, cause Fifth Third to lose customers or perform poorly or unprofitably. Future acquisition and investment activities and efforts to monitor newly acquired businesses or reap the benefits of a new strategic relationship may require Fifth Third to devote substantial time and resources and may cause these acquisitions, investments and relationships to be unprofitable or cause Fifth Third to be unable to pursue other business opportunities. After completing an acquisition, Fifth Third may find that certain material information was not adequately disclosed during the due diligence process or that certain items were not accounted for properly in accordance with financial accounting and reporting standards. Fifth Third may also not realize the expected benefits of the acquisition due to lower financial results pertaining to the acquired entity or assets. For example, Fifth Third could experience higher charge-offs than originally anticipated related to the acquired loan portfolio. Additionally, acquired companies or businesses may increase Fifth Third’s risk of regulatory action or restrictions related to the operations of the acquired business.

Fifth Third’s actual or alleged conduct in activities, such as certain sales and lending practices, data security, operational resiliency, governance, acquisitions, employee misconduct, service quality, or associations with certain customers, business partners, investments or vendors, as well as developments from any of the other risks described above, may damage Fifth Third’s reputation and generate negative public opinion. Since Fifth Third conducts most of its operations under the Fifth Third brand, reputational damage in one area can affect others. Regulatory actions, activist campaigns and community responses may also damage Fifth Third’s reputation. While traditional media once dominated public perception, social media now facilitates the rapid dissemination of information or misinformation. Though Fifth Third monitors social media channels, harmful content can still circulate widely that could damage Fifth Third’s reputation. Negative perception may adversely affect Fifth Third’s ability to attract and keep customers, increase litigation and regulatory action and raise the chance of accelerated deposits withdrawals.

Fifth Third’s actual or alleged conduct in activities, such as certain sales and lending practices, data security, operational resiliency, corporate governance and acquisitions, inappropriate behavior or misconduct of employees, failure to deliver minimum or required standards of service or quality, association with particular customers, business partners, investments or vendors, as well as developments from any of the other 36 Fifth Third Bancorp 36 Fifth Third Bancorp 36 Fifth Third Bancorp Table of Contents Table of Contents risks described above, may result in negative public opinion at large (or with certain segments of the public) and may damage Fifth Third’s reputation. Because Fifth Third conducts most of its businesses under the “Fifth Third” brand, negative public opinion about one business could affect its other businesses. Actions taken by government regulators, shareholder activists and community organizations may also damage Fifth Third’s reputation. Additionally, whereas negative public opinion once was primarily driven by adverse news coverage in traditional media, the advent and expansion of social media facilitates the rapid dissemination of information or misinformation. Though Fifth Third monitors social media channels, the potential remains for rapid and widespread dissemination of inaccurate, misleading or false information or other negative information that could damage Fifth Third’s reputation. Negative public perception can adversely affect Fifth Third’s ability to attract and keep customers and can increase the risk that it will be a target of litigation and regulatory action or experience an accelerated deposits withdrawal event.

The DIF is funded by fees assessed on insured depository institutions including the Bank. Future deposit premiums paid by the Bank depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. The FDIC may further increase the assessment rates or impose additional special assessments in the future, which may require the Bank to pay significantly higher FDIC premiums.

The FDIC maintains a Deposit Insurance Fund (“DIF”) to protect insured depositors in the event of bank failures. The DIF is funded by fees assessed on insured depository institutions including the Bank. Future deposit premiums paid by the Bank depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. As of June 30, 2020, the DIF reserve ratio fell to 1.30%, below the statutory minimum of 1.35%. In order to restore the DIF to its statutorily mandated minimums, the FDIC significantly increased deposit insurance premium rates, including the Bank’s, resulting in increased expenses. The revised assessment rate schedules became effective January 1, 2023, and were applicable to the first quarterly assessment period of 2023. Additionally, in November 2023, the FDIC issued a final rule for a special deposit insurance assessment to recover the costs associated with protecting uninsured depositors following the bank failures that occurred in 2023. Subsequently, in 2024, the FDIC announced that it expects to incur additional losses related to these bank failures beyond its initial estimates, resulting in an increase to the amount of the special assessment allocated to each member bank. The Bancorp currently expects to pay the special assessment to the FDIC over a total of ten quarterly assessment periods, which began with the first quarter of 2024. The FDIC may further increase the assessment rates or impose additional special assessments in the future, which may require the Bank to pay significantly higher FDIC premiums.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, and an established and growing demand for mobile and other phone and computer banking applications. Fifth Third’s future success depends, in part, upon Fifth Third’s ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in its operations. Fifth Third’s competitors may have substantially greater resources to invest in technological improvements. Fifth Third may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to its customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on Fifth Third’s business, financial condition and results of operations. Further, Fifth Third may utilize new technology, such as AI, in connection with its business and operations. AI may be developed internally by Fifth Third, or may be provided to Fifth Third by third- or fourth-party service providers. Any such new technology could have a significant impact on the effectiveness of Fifth Third’s system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, products or services and/or technologies could have a material adverse effect on Fifth Third’s business, financial condition and results of operations. AI may introduce Fifth Third to novel or intensified legal, regulatory, ethical, operational, reputational or other risks. AI models employed by Fifth Third or its service providers might be flawed due to improper design, implementation, or training or outputs based on data or algorithms that are incomplete, inadequate, misleading, biased or of poor quality. These flaws may not be easily identifiable. Additionally, there is no certainty that Fifth Third’s use of AI will successfully enhance its business operations or achieve its intended outcomes, and its competitors may adopt AI more swiftly or effectively than Fifth Third does. AI usage is subject to a range of existing laws and regulations. AI is also expected to be governed by new laws and regulations, or new applications of existing laws and regulations. AI is under ongoing scrutiny by various governmental and regulatory bodies, with federal, state and international authorities either implementing or considering legal frameworks that could impact Fifth Third’s ability to leverage AI effectively. Fifth Third may find it challenging to predict and adapt to these rapidly evolving legal requirements. Additionally, if Fifth Third does not possess adequate rights to the data or algorithms underpinning its AI solutions, or the outputs they generate, Fifth Third could face liabilities for breaching applicable laws and regulations. The limited experience with novel AI algorithms or applications within financial services generally, coupled with the swift pace of technological advancements and the rapid adoption of AI by Fifth Third’s partners and competitors, may hinder Fifth Third’s ability to effectively mitigate or detect these risks. Any perceived or actual shortcomings in addressing AI-related concerns could adversely affect Fifth Third’s business and operations.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services (including those related to or involving artificial intelligence, machine learning, blockchain and other distributed ledger technologies), and an established and growing demand for mobile and other phone and computer banking applications. Fifth Third’s future success depends, in part, upon Fifth Third’s ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in its operations. Many of Fifth Third’s competitors have substantially greater resources to invest in technological improvements. Fifth Third may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to its customers. In addition, Fifth Third’s implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in Fifth Third’s business processes may have unintended consequences due to its limitations or its failure to use them effectively. In addition, cloud technologies are also critical to the operation of Fifth Third’s systems, and its reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on Fifth Third’s business, financial condition and results of operations. Furthermore, any new technology could have a significant impact on the effectiveness of Fifth Third’s system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on Fifth Third’s business, financial condition and results of operations. 29 Fifth Third Bancorp 29 Fifth Third Bancorp 29 Fifth Third Bancorp Table of Contents Table of Contents

Fifth Third owns, or owns a minority stake in, as applicable, several businesses, investments and other assets that, in the future, may no longer be aligned with Fifth Third’s strategic plans or regulatory expectations. If Fifth Third were to sell one or more of its businesses or investments, it would be subject to market forces that may affect the timing or pricing of such sale or result in an unsuccessful sale. If Fifth Third were to complete the sale of any of its businesses, investments and/or interests in third parties, it would lose the income from the sold businesses and/or interests, including those accounted for under the equity method of accounting, and such loss of income could have an 36 Fifth Third Bancorp 36 Fifth Third Bancorp 36 Fifth Third Bancorp Table of Contents Table of Contents adverse effect on its future earnings and growth. Additionally, Fifth Third may encounter difficulties in separating the operations of any businesses it sells, which may affect its business or results of operations.

Fifth Third owns, or owns a minority stake in, as applicable, several businesses, investments and other assets that, in the future, may no longer be aligned with Fifth Third’s strategic plans or regulatory expectations. If Fifth Third were to sell one or more of its businesses or investments, it would be subject to market forces that may affect the timing or pricing of such sale or result in an unsuccessful sale. If Fifth Third were to complete the sale of any of its businesses, investments and/or interests in third parties, it would lose the income from the sold businesses and/or interests, including those accounted for under the equity method of accounting, and such loss of income could have an adverse effect on its future earnings and growth. Additionally, Fifth Third may encounter difficulties in separating the operations of any businesses it sells, which may affect its business or results of operations.

Fifth Third’s operations depend on operational and information technology systems, including financial, accounting, transaction-execution, and other operational systems, as well as devices, hardware, and networks supporting those systems, all of which may be operated by both Fifth Third and/or by third-party service providers. Failure, disruption, interruption or outage to any system may cause disruptions in critical business operations such as the ability to use accounting, deposit, loan, payment and other systems. It could also cause unfavorable effects to clients and customers, including delays or other disruptions in services, limitations on Fifth Third’s ability to collect data needed for its business, inability to settle or clear transactions, the possibility that fund transfers are completed erroneously and fraudulent transactions. While Fifth Third invests in automation and emerging technologies such as AI, to prevent, detect and remedy any interruptions or failures, manual oversight remains a critical component of its risk mitigation strategy. Exception handling and control testing are employed to help identify and remediate errors that may not be captured through automated processes. Despite these controls, failures are still possible and could result in operational disruptions or financial loss. In addition, any security compromise or information technology system disruptions in the financial services industry could interrupt Fifth Third’s business or operations, harm its reputation, erode borrower confidence, negatively affect Fifth Third’s ability to attract new members, or subject it to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect Fifth Third’s business and results of operations. Risks of operational failures, disruptions or outages in Fifth Third’s operational and information technology systems, and those provided by third-party providers, can result from a variety of factors, only some of which may be wholly or partially within the control of Fifth Third, its third-party providers or the financial services industry more generally. Such events could affect Fifth Third’s systems or limit Fifth Third’s ability to use information technology due to effects on underlying infrastructure. Although Fifth Third regularly updates and replaces systems that it depends on, financial institutions generally continue to utilize some older systems alongside newer systems. Causes of system failures, disruptions or outages may be difficult to detect. While the Bancorp believes that its current business continuity plans are adequate, there can be no assurance that such plans will fully mitigate all potential risks to Fifth Third, its customers or its clients. Third-party service providers with which Fifth Third does business, as well as vendors and other third parties with which Fifth Third’s customers do business, can also be sources of operational risk to Fifth Third, particularly where processes are highly concentrated or customer activities are beyond Fifth Third’s security and control systems, such as through the use of the internet, personal computers, tablets, smart phones and other mobile services. Fifth Third could also be held responsible for the failure of third-party service providers, as well as other third parties, to comply with applicable laws, rules or regulations. Any failures or disruptions of Fifth Third’s systems or operations, including in connection with outages or disruptions of systems provided by third parties, could adversely affect Fifth Third’s business and results of operations by subjecting Fifth Third to losses or liability, among other negative impacts, including reputational harm, litigation, regulatory fines or penalties or losses not covered by insurance.

Fifth Third’s operations, including its financial and accounting systems, use computer systems and telecommunications networks operated by both Fifth Third and third-party service providers. Fifth Third may not be sufficiently resilient and may not recover from significant operational events in a timely manner which could create operational and reputational risks. Additionally, Fifth Third collects, processes and stores sensitive consumer data by utilizing those and other systems and networks. Fifth Third has security, backup and recovery systems in place, as well as a business continuity plan to ensure the systems will not be inoperable. Fifth Third also has security to prevent unauthorized access to the systems. In addition, Fifth Third requires its third-party service providers to maintain similar controls. However, Fifth Third cannot be certain that the measures will be successful, particularly given the rapidly evolving sophistication of threat actors and technologies. A security breach in these systems or the loss or corruption of confidential information such as business results, transaction records and related information could adversely impact Fifth Third’s ability to provide timely and accurate financial information in compliance with legal and regulatory requirements, which could result in sanctions from regulatory authorities, significant reputational harm and the loss of customer confidence in Fifth Third. Additionally, security breaches or the loss, theft or corruption of customer information such as social security numbers, credit card numbers, account balances or other information could result in losses by Fifth Third's customers, litigation, regulatory sanctions, lost customers and revenue, increased costs and significant reputational harm. Fifth Third’s necessary dependence upon automated systems to record and process its transaction volume poses the risk that technical system flaws or employee errors, tampering or manipulation of those systems could result in losses and may be difficult to detect. Fifth Third may also be subject to disruptions of its operating systems arising from events that are beyond its control (for example, cyber-attacks, equipment failure, or electrical or telecommunications outages). Third-party service providers with which the Bancorp does business both domestically and offshore, as well as vendors and other third parties with which the Bancorp’s customers do business, can also be sources of operational risk to the Bancorp, particularly where processes are highly concentrated or in widespread use on critical Bancorp systems, or activities of customers are beyond the Bancorp’s security and control systems, such as through the use of the internet, personal computers, tablets, smart phones and other mobile services. Security breaches or system failures affecting the Bancorp or its third-party providers can increase operational costs and reduce customer satisfaction, as the Bancorp takes steps to protect its systems and safeguard confidential information. If personal, confidential or proprietary information of customers or clients in the Bancorp’s or such vendors’ or other third parties’ possession were to be mishandled or misused, the Bancorp could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling or misuse could include circumstances where, for example, such information was erroneously provided to parties who are not permitted to have the information, either through the fault of the Bancorp’s systems, employees or counterparties, or where such information was intercepted or otherwise compromised by threat actors. The Bancorp may be subject to disruptions of its operating systems arising from events that are wholly or partially beyond the 28 Fifth Third Bancorp 28 Fifth Third Bancorp 28 Fifth Third Bancorp Table of Contents Table of Contents Bancorp’s control, which may include, for example, security breaches; electrical or telecommunications outages; failures of computer components or servers or other damage to the Bancorp’s property or assets; natural disasters or severe weather conditions; health emergencies; or events arising from local or larger-scale political events, including outbreaks of hostilities or terrorist acts. While the Bancorp believes that its current business continuity plans are both sufficient and adequate, there can be no assurance that such plans will fully mitigate all potential business continuity risks to the Bancorp or its customers and clients. Any failures or disruptions of the Bancorp’s systems or operations could give rise to losses in service to customers and clients, adversely affect the Bancorp’s business and results of operations by subjecting the Bancorp to losses or liability, or require the Bancorp to expend significant resources to correct the failure or disruption, as well as by exposing the Bancorp to reputational harm, litigation, regulatory fines or penalties or losses not covered by insurance. In addition, any security compromise or information technology system disruptions in the financial services industry as a whole, whether actual or perceived, could interrupt the Bancorp’s business or operations, harm its reputation, erode borrower confidence, negatively affect the Bancorp’s ability to attract new members, or subject it to third-party lawsuits, regulatory fines or other action or liability, which could adversely affect Fifth Third’s business and results of operations. The Bancorp could also be adversely affected if it loses access to information or services from a third-party service provider as a result of a security breach or system or operational failure, or disruption affecting the third-party service provider. Fifth Third’s insurance may be inadequate to compensate for failures by, or affecting, third-party service providers upon which Fifth Third relies.