PNC Financial Services Group Inc.: 10-K Risk Factor Changes

There continues to be concern, including on the part of our regulators, regarding climate change and its impacts over the short-, medium- and long-term horizons. These concerns over the anticipated and unanticipated impacts of climate change (including physical risk and transition risk) have led and will continue to lead to governmental efforts to mitigate those impacts. We and our customers The PNC Financial Services Group, Inc. – 2023 Form 10-K 19 The PNC Financial Services Group, Inc. – 2023 Form 10-K 19 The PNC Financial Services Group, Inc. – 2023 Form 10-K 19 may face cost increases, asset value reductions, the reduced availability of insurance, operations disruptions and changes and the like because of climate change (including because of the increased frequency or severity of acute weather events and long-term shifts in the climate) and governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses are also changing their behaviors because of these concerns. Changed consumer and business behavior because of climate change concerns creates transition risk for PNC arising from the process of adjusting to these concerns. PNC and its customers will need to respond to new laws and regulations as well as consumer and business preferences as a result. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Our efforts to take these risks into account in making lending and other decisions may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior, including those resulting from activist pressure. Our risk management needs to continue to evolve, or it may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable. We also have been and may continue to be subject to conflicting pressure from individuals, groups and/or governmental entities to cease doing business, or to maintain business, with certain companies or sectors, in particular those involved with fossil fuels, because of concerns related to climate change. Further, there is increased scrutiny of climate change-related policies, goals and disclosures, which could result in litigation and regulatory investigations and actions. Our stakeholders may disagree with these policies and goals or, conversely, believe that these policies and goals are, and our related progress in accomplishing such goals and implementing such policies is, insufficient. This may lead to a decrease in demand for our products and services or damage to our reputation. We may also incur additional costs and require additional resources as we evolve our strategy, practices and related disclosures with respect to these matters. In addition, there are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data that is subject to measurement uncertainties. The Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation” further discusses risks associated with our management of these matters, including related activist pressure.

There continues to be concern, including on the part of our regulators, regarding climate change and its impacts on virtually all aspects of life over the short-, medium- and long-term horizons. These concerns over the anticipated and unanticipated impacts of climate change (including physical risk and transition risk) have led and will continue to lead to governmental efforts around the world to mitigate those impacts. We and our customers may face cost increases, asset value reductions, operations disruptions and changes and the like because of climate change (including severe weather events) and governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses are also changing their behaviors because of these concerns. Changed consumer and business behavior because of climate change concerns creates transition risk for PNC arising from the process of adjusting to these concerns, including transitioning to a low-carbon economy. PNC and its customers will need to respond to new laws and regulations as well as consumer and business preferences as a result. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. We also have been and may continue to be subject to pressure from individuals or groups to cease doing business with certain companies or sectors because of concerns related to climate change. We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Further, there is increased scrutiny of climate change-related policies, goals and disclosures, which could result in litigation and regulatory investigations and actions. We may incur additional costs and require additional resources as we evolve our strategy, practices and related disclosures with respect to these matters. 20 The PNC Financial Services Group, Inc. – 2022 Form 10-K 20 The PNC Financial Services Group, Inc. – 2022 Form 10-K 20 The PNC Financial Services Group, Inc. – 2022 Form 10-K The Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation” further discusses risks associated with our management of environmental, social and governance matters, including related activist pressure. Our efforts to take these risks into account in making lending and other decisions may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior, including those resulting from activist pressure. Our risk management may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.

Changes in law or governmental policy affecting the economy, business activity, or personal spending, investing or saving activities may cause consumers and businesses to alter their behavior in ways that impact demand for our products and services. Such changes may also alter the profitability of the transactions in which we engage or result in increased regulatory burden and associated costs. PNC may alter the types or terms of the products and services we offer to reflect such changes. Uncertainty regarding future law or policy may have similar impacts. In addition, the application of some laws may be uncertain, require significant judgment and be 16 The PNC Financial Services Group, Inc. – 2023 Form 10-K 16 The PNC Financial Services Group, Inc. – 2023 Form 10-K 16 The PNC Financial Services Group, Inc. – 2023 Form 10-K subject to differing interpretations. Congress and the agencies that regulate us have changed and may continue to change the laws and policies that are applicable to us, including their interpretations of rules and guidelines, which has subjected and may continue to subject financial institutions like us to heightened levels of regulation and supervision and more stringent enforcement and potentially severe penalties. For example, the increased time frames and difficulty in obtaining regulatory approvals for acquisitions and other activities could affect our ability to make acquisitions or introduce new products and services. As another example, tax laws and tax rates may be subject to significant change and an increase in our effective tax rates could adversely affect our business, results of operation and financial condition. In addition, these changes may adversely impact our operations or financial condition as discussed in more detail in the Risk Factor headed “As a regulated financial services firm, we are subject to numerous governmental regulations and comprehensive oversight by a variety of regulatory agencies and enforcement authorities. These regulations and their implementation can have a significant impact on our businesses and operations and our ability to grow and expand.” Concern regarding the ability of Congress and the President collectively to reach agreement on federal budgetary matters (including the debt ceiling), or prolonged stalemates leading to total or partial governmental shutdowns, also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance. Divided control of the U.S. government increases concern over the inability of Congress and the President to reach necessary agreements and make government shutdowns or defaults in government obligations more likely.

Changes in law or governmental policy affecting the economy, business activity, or personal spending, investing or saving activities may cause consumers and businesses to alter their behavior in ways that impact demand for our products and services. Such changes may also alter the profitability of the transactions in which we engage or result in increased regulatory burden and associated costs. PNC may alter the types or terms of the products and services we offer to reflect such changes. Uncertainty regarding future law or policy may have similar impacts. In addition, the application of some laws may be uncertain, require significant judgment and be subject to differing interpretations. Congress and the agencies that regulate us have changed and may continue to change the laws and policies that are applicable to us, including their interpretations of rules and guidelines, which has subjected and may continue to subject financial institutions like us to heightened levels of regulation and supervision and more stringent enforcement and potentially severe penalties. For example, the increased time frames and difficulty in obtaining regulatory approvals for acquisitions and other activities could affect our ability to make acquisitions or introduce new products and services. As another example, tax laws and tax rates may be subject to significant change and an increase in our effective tax rates could adversely affect our business, results of operation and financial condition. In addition, these changes may adversely impact our operations or financial condition as discussed in more detail in the Risk Factor headed “As a regulated financial services firm, we are subject to numerous governmental regulations and comprehensive oversight by a variety of regulatory agencies and enforcement authorities. These regulations and the way they are implemented can have a significant impact on our businesses and operations and our ability to grow and expand.” Some of the legislation responsive to the COVID-19 pandemic (such as the CARES Act and the Consolidated Appropriations Act that provided for certain commercial and consumer protections) altered the profitability of the transactions in which we engage, and other laws related to employee benefits increased administrative, compensation and benefits costs to us. Other such laws may be enacted in response to other extraordinary events beyond PNC’s control that have similar or broader effects on us and could adversely affect our financial condition and results of operations, possibly materially, in other ways that are not now known to us. Concern regarding the ability of Congress and the President collectively to reach agreement on federal budgetary matters (including the debt ceiling), or prolonged stalemates leading to total or partial governmental shutdowns, also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance. Divided control of the U.S. government may increase concern over the inability of Congress and the President to reach necessary agreements and make government shutdowns or defaults in government obligations more likely.

PNC and PNC Bank are subject to regulatory capital and liquidity requirements established by the Federal Reserve and the OCC, respectively. These regulatory capital and liquidity requirements are typically developed at an international level by the Basel Committee and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies can apply stricter capital and liquidity standards than those developed by the Basel Committee. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations. Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as the limitations on distributions imposed in response to the COVID-19 pandemic and the 2007-2008 financial crisis. In addition, dividends from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations. Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective. 18 The PNC Financial Services Group, Inc. – 2023 Form 10-K 18 The PNC Financial Services Group, Inc. – 2023 Form 10-K 18 The PNC Financial Services Group, Inc. – 2023 Form 10-K Regulatory capital and liquidity requirements are subject to regular review and revision by the Basel Committee and the U.S. banking agencies. In July 2023, the Federal Reserve, OCC, and FDIC proposed for public comment a rule to implement the final components of the Basel III framework that would significantly revise the capital requirements for large banking organizations, including PNC and PNC Bank. We expect the proposal, if finalized in its current form, would result in lower regulatory capital ratios for PNC and PNC Bank, which would likely increase the risk of some of the potential adverse effects described above. The regulatory capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, are discussed in the Supervision and Regulation section of this Report and the Liquidity and Capital Management portion of the Risk Management section of this Report.

PNC and PNC Bank are subject to regulatory capital and liquidity requirements established by the Federal Reserve and the OCC, respectively. These regulatory capital and liquidity requirements are typically developed at an international level by the Basel Committee and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies can apply stricter capital and liquidity standards than those developed by the Basel Committee. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations. Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as the limitations on distributions imposed in response to the COVID-19 pandemic and the 2007-2008 financial crisis. In addition, dividends from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations. Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective. The Basel Committee continues to develop policies and standards for the prudential regulation of banks. See the Supervision and Regulation section of this Report. Generally, as it is unclear whether or how these initiatives will be implemented in the U.S., we are unable to estimate what potential impact such initiatives may have on us. We expect the federal banking agencies to propose rules in 2023 to implement the capital- and liquidity-related final set of Basel III standards issued by the Basel Committee in December 2017. Regulatory capital and liquidity requirements are subject to regular review and revision by the Basel Committee and the U.S. banking agencies. For example, under the 2019 Tailoring Rules, certain BHCs are classified as Category I, Category II, Category III or Category IV firms. While PNC and PNC Bank currently are Category III firms, if PNC or PNC Bank became a Category I or II institution, we would be subject to more stringent capital and liquidity standards, which would likely increase some of the potential adverse effects described above. Future changes to the capital and liquidity rules to require PNC or PNC Bank to maintain more or higher quality capital or greater liquidity would also likely increase some of the potential adverse effects described above. The regulatory capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, are discussed in the Supervision and Regulation section of this Report and the Liquidity and Capital Management portion of the Risk Management section of this Report.

Our use of third parties to support our business needs typically means that we do not directly control the activities we are having them perform. Any disruption in services provided by these third parties could adversely affect our ability to conduct our business. Replacing third parties could also entail significant delay and expense. Risks can arise through inadequate performance by a third party (including by its downstream service providers), specifically where that performance could affect us or our customers, and even when the result of factors or events are beyond such third party’s control. Many of the kinds of risks presented by activities performed by third parties are described elsewhere in these Risk Factors. Enhanced regulatory and other standards for the oversight of our use of third-party vendors and other service providers can result in higher costs and other potential exposures. We are also vulnerable, including to regulatory penalties, if an outside company fails to comply with legal requirements relevant to its work on our behalf. We may in any such circumstance suffer financial losses, legal consequences and injury to our reputation. Even if the other company makes us whole for financial losses, which is not necessarily the case, it is unlikely that it would be able to restore any injury to our reputation. As a result, the use of third parties to assist in our business activities heightens the risks to us inherent in those activities.

Our use of third parties to support our business needs typically means that we do not directly control the activities we are having them perform. Any disruption in services provided by these third parties could adversely affect our ability to conduct our business. Replacing third parties could also entail significant delay and expense. Risks can arise through inadequate performance by a third party (including by its downstream service providers), specifically where that performance could affect us or our customers, and even when the result of factors or events are beyond such third party’s control. Many of the kinds of risks presented by activities performed by third parties are described elsewhere in these Risk Factors. For example, we use outside companies to assist us in processing some confidential customer or employee information. In such a case, a cyber attack on such a company may result in access to our customers’ or employees’ information. We are also vulnerable, including to regulatory penalties, if an outside company fails to comply with legal requirements relevant to its work on our behalf. We may in any such circumstance suffer financial losses, legal consequences and injury to our reputation. Even if the other company makes us whole for financial losses, which is not necessarily the case, it is unlikely that it would be able to restore any injury to our reputation. As a result, the use of third parties to assist in our business activities heightens the risks to us inherent in those activities.

Our performance is dependent on attracting and retaining talented and diverse employees. We face significant competition for these employees across many of our businesses and support areas. This presents greater risk as we expand into new markets, develop new product lines, or enhance staffing in certain areas, particularly technology. This competition leads to increased expenses in affected business areas. Differences in demands, expectations and priorities of the workforce (such as remote work expectations) may require us to modify our recruiting and retention strategies to attract and retain employees. Limitations on the way regulated financial institutions can compensate their officers and employees, including those contained in pending rule proposals implementing requirements of Dodd-Frank, may make it more difficult for regulated financial institutions, including PNC, to compete with other companies for talent.

Our performance is dependent on attracting and retaining talented and diverse employees. We face significant competition for these employees across many of our businesses and support areas. This presents greater risk as we expand into new markets, develop new product lines, or enhance staffing in certain areas, particularly technology. This competition leads to increased expenses in affected business areas. In addition, changes to the labor market as a result of the COVID-19 pandemic (including elevated employee attrition, labor availability and wage inflation) have exacerbated and may continue to exacerbate the challenges of attracting and retaining talented and diverse employees. Differences in demands, expectations and priorities of the workforce (such as remote work expectations) may require us to modify our recruiting and retention strategies to attract and retain employees. Limitations on the way regulated financial institutions can compensate their officers and employees, including those contained in pending rule proposals implementing requirements of Dodd-Frank, may make it more difficult for regulated financial institutions, including PNC, to compete with unregulated companies for talent. 28 The PNC Financial Services Group, Inc. – 2022 Form 10-K 28 The PNC Financial Services Group, Inc. – 2022 Form 10-K 28 The PNC Financial Services Group, Inc. – 2022 Form 10-K

Most corporate and commercial financial transactions are now handled electronically, and our commercial and retail customers increasingly use online access as well as mobile and cloud technologies to bank with us. The ability to conduct business with us in this manner depends on the transmission and storage of confidential information in electronic form. As a result, in the ordinary course of business, we maintain and process vast amounts of digital information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive. Such highly sensitive information includes information sufficient to support identity theft and personal health information, as well as information regarding business plans and financial performance that has not been made public. As a result, efforts by bad actors to engage in various types of cyber attacks pose serious risks to our business and reputation. We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. These efforts may be to obtain access to confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information maintained by us. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened because of our expanded digital products and services, geographic footprint and continued remote work environment, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise to the extent that third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breaches and attacks, which may impact our systems or operations. Our ability to protect confidential or proprietary information is even more limited with respect to information held by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve breaches and attacks that may impact our business the further removed an entity is from our business, such as when a breach or attack occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information held by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it. Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions, and other internet-based financial product offerings. For example, a number of our customers choose to use financial applications that allow them to view, access and aggregate banking and other financial account information, often held at different financial institutions, on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Financial applications often ask users to provide their secure banking log-in information and credentials so the applications can link to users’ accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications. To do this, data aggregators frequently are provided with customers’ log-in information and credentials, which allow the aggregators to access the customers’ online accounts and “scrape” the customers’ data, often on a daily or even more frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where PNC does not have financial exposure for losses, PNC could suffer increased reputational harm when such losses occur. As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may 22 The PNC Financial Services Group, Inc. – 2023 Form 10-K 22 The PNC Financial Services Group, Inc. – 2023 Form 10-K 22 The PNC Financial Services Group, Inc. – 2023 Form 10-K be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts. Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. Attacks have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other attacks have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, attacks have been conducted through application program interfaces where cyber attackers seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or data security breaches. In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the increase in the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access. We have been and expect to continue to be the target of some of these types of cyber attacks. To date, none of these types of cyber attacks has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no assurance that future cyber attacks will not be material. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks.

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened because of our increased remote work environment, which results in more access points to our network. Most corporate and commercial transactions are now handled electronically, and our retail customers increasingly use online access as well as mobile and cloud technologies to bank with us. The ability to conduct business with us in this manner depends on the transmission and storage of confidential information in electronic form. As a result, efforts by bad actors to engage in various types of cyber attacks pose serious risks to our business and reputation. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise to the extent that third parties with whom we do business are subject themselves to breaches and attacks, which may impact our systems. In the ordinary course of business, we maintain and process vast amounts of information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive. Such highly sensitive information includes information sufficient to support identity theft and personal health information, as well as information regarding business plans and financial performance that has not been made public. One way in which bad actors attempt to harm us is by seeking access to some of this confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers. In other cases, they seek to disrupt our ability to conduct our business, including by destroying or impairing our access to information maintained by us. Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and 22 The PNC Financial Services Group, Inc. – 2022 Form 10-K 22 The PNC Financial Services Group, Inc. – 2022 Form 10-K 22 The PNC Financial Services Group, Inc. – 2022 Form 10-K their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions, and other internet-based financial product offerings. As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts. Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and may use this information to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. A number of companies have fallen victim to business email compromise scams in recent years. Business email compromise scams involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. Other attacks in recent years have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” The techniques used in cyber attacks change rapidly and frequently and are increasingly sophisticated, and we may not be able to anticipate cyber attacks or data security breaches. In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the increase in the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access. We are and have been the target of some of these types of cyber attacks. To date, none of these types of cyber attacks has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no assurance that future cyber attacks will not be material. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks. Our ability to protect confidential or proprietary information is even more limited with respect to information held by third parties. We may suffer reputational damage or legal liability for unauthorized access to customer information held by third parties, even if we were in fact not responsible for preventing such access and had no reasonable way of preventing it.

Our ability to compete effectively, to attract and retain customers and employees, and to grow our business is dependent on maintaining our reputation and having the trust of our customers, employees, the communities that we serve and other stakeholders. Many types of developments, if publicized, can negatively impact a company’s reputation with adverse consequences to its business. Financial services companies are highly vulnerable to reputational damage when they are found to have harmed customers, particularly retail customers, through conduct that is seen as illegal, unfair, deceptive, abusive, manipulative or otherwise wrongful. There also may be reputational damage from human error or systems failures viewed as having harmed customers without involving misconduct, including service disruptions or negative perceptions regarding our ability to maintain the security of our technology systems and protect client data. For example, we may suffer reputational harm to the extent that we are unable to successfully detect, prevent and remedy fraud that harms our clients. Our reputation may also be harmed by failing to deliver products and services of the quality expected by our customers and support the communities that we serve. In addition, our reputation may be harmed as a result of our participation in certain programs, such as those supporting diversity and inclusion, that may expose us to increased scrutiny and criticism. Significant acquisitions by large banks also often attract public scrutiny, which may result in negative publicity that adversely affects our reputation if we engage in such a transaction. We are also subject to the risk of reputational harm resulting from conduct of persons identified as our employees but acting outside of the scope of their employment, including through their misconduct, unethical behavior, or activities on personal social media. The reputational impact is likely greater to the extent that the bad conduct, errors or failures are pervasive, long-standing or affect a significant number of customers, particularly retail consumers. The negative impact of such reputational damage on our business may be disproportionate to the actual harm caused to customers. It may be severe even if we fully remediate any harm suffered by our customers. Furthermore, because we conduct most of our businesses under the “PNC” brand, negative public opinion about one business could also affect our other businesses. In addition, we could suffer reputational harm and a loss of customer trust as a result of the conduct of others in our industry even if we have not engaged in such conduct. We use third parties to help in many aspects of our business, with the risk that their conduct can affect our reputation regardless of the degree to which we are responsible for it. To an increasing extent, financial services companies, including PNC, are facing criticism with accompanying reputational risk from activists, investors and stakeholders who believe companies should be focusing more or less on environmental, social and governance matters. Companies in our industry, including PNC, are targeted for engaging in business with specific customers or with customers in particular industries, where the customers’ activities, even if legal, are perceived as having harmful impacts on matters such as the environment, consumer health and safety, or society at large. In addition, some activists, investors and other stakeholders are seeking increased transparency and action from financial services companies with respect to environmental, social and governance activities, political activities and activities that are or may be perceived to be politically partisan in nature. Criticism has come in many forms, including protests at PNC facilities and social media campaigns. In some circumstances, our stakeholders have held and continue to hold conflicting views on the role PNC and other financial services companies should play in continuing to or refraining from financing certain sectors. In some cases, we are subject to potentially conflicting proposed and enacted state and local laws affecting our industry that regulate the manner in which or whether we may finance or service certain clients, industries or sectors. Many of these issues are divisive without broad agreement as to the appropriate steps a company such as PNC should take. As a result, however we respond to such criticism, we expose ourselves to the risks that current or potential customers decline to do business with us or current or potential employees refuse to work for us. This can be true regardless of whether we are perceived by some as not having done enough to address these concerns or by others as having inappropriately yielded to these pressures. These pressures can also be a factor in decisions as to which business opportunities and customers we pursue, potentially resulting in foregone profit opportunities. The speed with which information moves through social media and other news sources on the internet means that negative information about PNC can rapidly have a broadly adverse impact on our reputation. This is true whether or not the information is accurate. False information can also be spread from unaffiliated or parody social media accounts pretending to be official company communications channels. Once information has gone viral, it can be difficult to counter it effectively, either by correcting inaccuracies or communicating remedial steps taken for actual issues. The potential impact of negative information going viral means that material reputational harm can result from a single discrete or isolated incident. 28 The PNC Financial Services Group, Inc. – 2023 Form 10-K 28 The PNC Financial Services Group, Inc. – 2023 Form 10-K 28 The PNC Financial Services Group, Inc. – 2023 Form 10-K

Our ability to compete effectively, to attract and retain customers and employees, and to grow our business is dependent on maintaining our reputation and having the trust of our customers, employees, the communities that we serve and other stakeholders. Many types of developments, if publicized, can negatively impact a company’s reputation with adverse consequences to its business. Financial services companies are highly vulnerable to reputational damage when they are found to have harmed customers, particularly retail customers, through conduct that is seen as illegal, unfair, deceptive, abusive, manipulative or otherwise wrongful. There also may be reputational damage from human error or systems failures viewed as having harmed customers without involving misconduct, including service disruptions or negative perceptions regarding our ability to maintain the security of our technology systems and protect client data. For example, we may suffer reputational harm to the extent that we are unable to successfully detect, prevent and remedy fraud that harms our clients. Our reputation may also be harmed by failing to deliver products and services of the quality expected by our customers and support the communities that we serve. In addition, our reputation may be harmed as a result of our participation in certain programs, such as the PPP and the processing of unemployment benefits during the COVID-19 pandemic, that has exposed and may continue to expose us to increased scrutiny and criticism. The reputational impact is likely greater to the extent that the bad conduct, errors or failures are pervasive, long-standing or affect a significant number of customers, particularly retail consumers. The negative impact of such reputational damage on our business may be disproportionate to the actual harm caused to customers. It may be severe even if we fully remediate any harm suffered by our customers. Furthermore, because we conduct most of our businesses under the “PNC” brand, negative public opinion about one business could also affect our other businesses. In addition, we could suffer reputational harm and a loss of customer trust as a result of the conduct of others in our industry even if we have not engaged in such conduct. We use third parties to help in many aspects of our business, with the risk that their conduct can affect our reputation regardless of the degree to which we are responsible for it. The PNC Financial Services Group, Inc. – 2022 Form 10-K 27 The PNC Financial Services Group, Inc. – 2022 Form 10-K 27 The PNC Financial Services Group, Inc. – 2022 Form 10-K 27 To an increasing extent, financial services companies, including PNC, are facing criticism with accompanying reputational risk from social and environmental activists, and from investors and other stakeholders who believe companies should be focusing more or less on environmental, social and governance matters. Companies in our industry, including PNC, are targeted for engaging in business with specific customers or with customers in particular industries, where the customers’ activities, even if legal, are perceived as having harmful impacts on matters such as the environment, consumer health and safety, or society at large. In addition, activists, investors and other stakeholders of companies in our industry, including PNC, are seeking increased transparency and action with respect to environmental, social and governance activities, political activities and activities that are or may be perceived to be politically partisan in nature. Criticism has come in many forms, including protests at PNC facilities and social media campaigns. PNC and many other financial services companies have in recent years been criticized for financing companies engaged in, for example, extraction and distribution of fossil fuels, manufacture of nuclear and other weapons (including personal firearms), private prisons and border control activities. In contrast, state laws affecting our industry have been proposed and, in some cases, enacted reflecting opposite approaches. For example, to conduct most business with a municipality in Texas, PNC must certify, among other things, that it does not discriminate against the firearms industry or the fossil fuel industry. Many of these issues are divisive without broad agreement as to the appropriate steps a company such as PNC should take. As a result, however we respond to such criticism, we expose ourselves to the risks that current or potential customers decline to do business with us or current or potential employees refuse to work for us. This can be true regardless of whether we are perceived by some as not having done enough to address these concerns or by others as having inappropriately yielded to these pressures. These pressures can also be a factor in decisions as to which business opportunities and customers we pursue, potentially resulting in foregone profit opportunities. The speed with which information moves through social media and other news sources on the internet means that negative information about PNC can rapidly have a broadly adverse impact on our reputation. This is true whether or not the information is accurate. False information can also be spread from unaffiliated or parody social media accounts pretending to be official company communications channels. Once information has gone viral, it can be difficult to counter it effectively, either by correcting inaccuracies or communicating remedial steps taken for actual issues. The potential impact of negative information going viral means that material reputational harm can result from a single discrete or isolated incident. We are also subject to the risk of reputational harm resulting from conduct of persons identified as our employees but acting outside of the scope of their employment, including through their misconduct, unethical behavior, or activities on personal social media.

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can view, access and aggregate financial data, make payments or manage their accounts. In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we have been investing in technology and connectivity. We are seeking to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved and is likely to continue to involve the expenditure of considerable amounts of funds and other resources, which could be constrained to the extent that sustained adverse economic conditions and other factors described elsewhere in these Risk Factors negatively impact our business or financial performance. A failure to maintain or enhance our competitive position with respect to technology, whether because we fail to anticipate customer expectations, because our technological developments fail to perform as desired or are not rolled out in a timely manner, or because we fail to keep pace with our competitors, would likely cause us to lose market share or incur additional expense. Our ability to maintain or enhance our relative technological position is in part dependent on our ability to attract and retain talented employees in these fields, which, due to overall demand, is increasingly difficult. 20 The PNC Financial Services Group, Inc. – 2023 Form 10-K 20 The PNC Financial Services Group, Inc. – 2023 Form 10-K 20 The PNC Financial Services Group, Inc. – 2023 Form 10-K

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, virtual and augmented reality, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can make payments or manage their accounts. The emergence of many of these technologies was accelerated as a result of the COVID-19 pandemic and the shift to increased digital activity. We expect these trends to continue for the foreseeable future. In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we have been investing in technology and connectivity. We are seeking to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved the expenditure of considerable amounts of funds and other resources. A failure to maintain or enhance our competitive position with respect to technology, whether because we fail to anticipate customer expectations, because our technological developments fail to perform as desired or are not rolled out in a timely manner, or because we fail to keep pace with our competitors, would likely cause us to lose market share or incur additional expense. Our ability to maintain or enhance our relative technological position is in part dependent on our ability to attract and retain talented employees in these fields, which, due to overall demand, is increasingly difficult.

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by commercial and residential real estate typically represent a significant percentage of our overall credit portfolio. They also represent a portion of the assets underlying our investment securities. While there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting some of our clients or counterparties, based on individual factors or the nature or location of their business, or asset classes or financial markets in which we are involved, could materially and adversely affect us. For example, any downturn in the condition of the U.S. housing market could result in significant write-downs of asset values tied to residential real estate. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries. Financial services institutions are interrelated because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by commercial and residential real estate typically represent a significant percentage of our overall credit portfolio. They also represent a portion of the assets underlying our investment securities. Although there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting specific 24 The PNC Financial Services Group, Inc. – 2022 Form 10-K 24 The PNC Financial Services Group, Inc. – 2022 Form 10-K 24 The PNC Financial Services Group, Inc. – 2022 Form 10-K customers or counterparties, industries, geographies, asset classes or financial markets, including a decline in their creditworthiness or a worsening overall risk profile, could materially and adversely affect us. For example, any downturn in the condition of the U.S. housing market could result in significant write-downs of asset values tied to residential real estate. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries. Financial services institutions are interrelated because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

The need to ensure proper functioning and resiliency of our information systems and other technology has become more important and more challenging, and the costs involved in that effort continue to be high. Our ability to create, obtain, maintain and report on information in an accurate, timely and secure manner is a foundational component of our business. Effective management of our expanded digital products and services, geographic footprint and continued remote work environment heightens our need for secure, reliable and adequate information systems and technology. The risks of operational failures in the use of these systems result from a variety of factors. We are vulnerable to the impact of failures of our systems to operate as needed or intended. Failures leading to materially adverse impacts could include those resulting from human error, unexpected transaction volumes, or overall security, design or performance issues. In addition, our ability to use our technology effectively could be impacted due to electrical or telecommunications outages, bad weather, disasters, bad actors, terrorism and the like. Such events could affect our systems directly or limit our ability to use our technology due to effects on key underlying infrastructure. Although we regularly update and replace systems that we depend on as our needs evolve and technology improves, we continue to utilize some older systems that may not be as reliable as newer ones. In addition, the implementation of and transition to new or updated systems creates risks related to associated timing and costs, disruptions in functionality for customers and longer-term failures to achieve desired improvements. In some cases, the risk results from the potential for bad acts on the part of others, discussed in more detail in the Risk Factor headed “We are vulnerable to the risk of breaches of data security affecting the functioning of systems or the confidentiality of information that could adversely affect our customers and our business.” We also rely on information systems maintained by other companies. We use other companies both to provide products and services directly to us and to assist us in providing products and services to our customers. Others provide the infrastructure that supports, for example, communications, payment, clearing and settlement systems, or information processing and storage. These companies range from those providing highly sophisticated information processing to those that provide fundamental services, such as electric power and telecommunications. In some cases, these other companies themselves utilize third parties to support their delivery of products and services to us and our customers. Systems maintained by or for these other companies are generally subject to many of the same risks we face with respect to our systems and thus their issues could have a negative impact on PNC. We necessarily have less ability to provide oversight over other companies’ information systems. The occurrence of any failure, interruption or security breach of any of our information or communications systems, or the systems of other companies on which we rely, could result in a wide variety of adverse consequences to us. This risk is greater if the issue is widespread, extends for a significant period of time, or results in financial losses to our customers. The consequences of failures to operate systems properly can result in disruptions to our critical business operations, including our ability to use our accounting, deposit, loan, payment and other systems. Such events could also cause errors in transactions or impair system functionality with customers, vendors or other parties. Possible adverse consequences also include damage to our reputation or a loss of customer business, which could occur even if the negative impact on customers was de minimis. We also could face litigation or additional regulatory scrutiny. This in turn could lead to liability or other sanctions, including fines and penalties or reimbursement of adversely affected customers. Even if we do not suffer any material adverse consequences as a result of events affecting us directly, information systems issues at other financial institutions could lead to a general loss of customer confidence in financial institutions, including us. Also, system problems, including those resulting from third-party attacks, whether at PNC or at our competitors, may broadly increase legislative, regulatory and customer concerns regarding the functioning, safety and security of such systems. In that case, we would expect to incur even higher levels of costs with respect to prevention and mitigation of these risks. The PNC Financial Services Group, Inc. – 2023 Form 10-K 21 The PNC Financial Services Group, Inc. – 2023 Form 10-K 21 The PNC Financial Services Group, Inc. – 2023 Form 10-K 21

The need to ensure proper functioning and resiliency of our information systems and other technology has become more important and more challenging, and the costs involved in that effort continue to be high. Our ability to create, obtain, maintain and report on information in an accurate, timely and secure manner is a foundational component of our business. Effective management of our expanded remote work environment heightens our need for secure, reliable and adequate information systems and technology. The risks of operational failures in the use of these systems result from a variety of factors. We are vulnerable to the impact of failures of our systems to operate as needed or intended. Failures leading to materially adverse impacts could include those resulting from human error, unexpected transaction volumes, or overall security, design or performance issues. In addition, our ability to use our technology effectively could be impacted due to electrical or telecommunications outages, bad weather, disasters, bad actors, terrorism and the like. Such events could affect our systems directly or limit our ability to use our technology due to effects on key underlying infrastructure. In some cases, the risk results from the potential for bad acts on the part of others, discussed in more detail in the Risk Factor headed “We are vulnerable to the risk of third-party breaches of data security affecting the functioning of systems or the confidentiality of information, either at PNC or at third parties handling PNC information.” We also rely on information systems maintained by other companies. We use other companies both to provide products and services directly to us and to assist us in providing products and services to our customers. Others provide the infrastructure that supports, for example, communications, payment, clearing and settlement systems, or information processing and storage. These companies range from those providing highly sophisticated information processing to those that provide fundamental services, such as electric power and telecommunications. In some cases, these other companies themselves utilize third parties to support their delivery of products and services to us and our customers. Systems maintained by or for these other companies are generally subject to many of the same risks The PNC Financial Services Group, Inc. – 2022 Form 10-K 21 The PNC Financial Services Group, Inc. – 2022 Form 10-K 21 The PNC Financial Services Group, Inc. – 2022 Form 10-K 21 we face with respect to our systems and thus their issues could have a negative impact on PNC. We necessarily have less ability to provide oversight over other companies’ information systems. A number of our customers choose to use financial applications that allow them to view banking and other financial account information, often held at different financial institutions, on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Financial applications often ask users to provide their secure banking log-in information and credentials (such as usernames and passwords) so the applications can link to users’ accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications. To do this, data aggregators are provided with customers’ log-in information and credentials, which allow the aggregators to access the customers’ online accounts and “scrape” the customers’ data, often on a daily or even more frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In some cases, cybercriminals appear to be using such data aggregators and integrators to facilitate account takeovers and fraudulent wires. PNC has and may continue to face increased financial exposure due to fraudulent activity associated with the increased use of these applications and data aggregators. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. Even where PNC does not have responsibility for fraud losses associated with any of these applications and data aggregators, PNC could suffer increased reputational harm when such losses occur. Although we regularly update and replace systems that we depend on as our needs evolve and technology improves, we continue to utilize some older systems that may not be as reliable as newer ones. In addition, the implementation of and transition to new or updated systems creates risks related to associated timing and costs, disruptions in functionality for customers and longer-term failures to achieve desired improvements. The occurrence of any failure, interruption or security breach of any of our information or communications systems, or the systems of other companies on which we rely, could result in a wide variety of adverse consequences to us. This risk is greater if the issue is widespread, extends for a significant period of time, or results in financial losses to our customers. The consequences of failures to operate systems properly can result in disruptions to our critical business operations, including our ability to use our accounting, deposit, loan, payment and other systems. Such events could also cause errors in transactions or impair system functionality with customers, vendors or other parties. Possible adverse consequences also include damage to our reputation or a loss of customer business, which could occur even if the negative impact on customers was de minimis. We also could face litigation or additional regulatory scrutiny. This in turn could lead to liability or other sanctions, including fines and penalties or reimbursement of adversely affected customers. Even if we do not suffer any material adverse consequences as a result of events affecting us directly, information systems issues at other financial institutions could lead to a general loss of customer confidence in financial institutions, including us. Also, system problems, including those resulting from third-party attacks, whether at PNC or at our competitors, may broadly increase legislative, regulatory and customer concerns regarding the functioning, safety and security of such systems. In that case, we would expect to incur even higher levels of costs with respect to prevention and mitigation of these risks.

Given the nature of our business, our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S. Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns, higher inflation and unemployment. This may be further exacerbated by a deterioration in households’ finances, particularly if consumers also continue to face high inflation. In addition, adverse economic conditions, including periods of inflation, may limit the availability of, or increase the costs of, capital and labor, erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services. We operate in an uncertain economic environment due to structural and secular changes triggered by the pandemic for certain sectors of the economy combined with increased interest rates, inflation and geopolitical tensions. These conditions may not abate in the near term, and their continuation could materially adversely affect our operations and financial performance. Such economic conditions also have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally depending on the nature and severity of the adverse economic conditions. Even when economic conditions are relatively good or stable, specific economic factors can negatively affect our business and performance. This can be especially true when the factors relate to particular segments of the economy. For example, as remote work continues to be a feasible alternative to pre-pandemic in-office work arrangements, notable portions of available commercial real estate space remain underutilized. This likely decreases demand for financial services in that sector and harms the creditworthiness of some of our office commercial real estate customers, as well as businesses whose customers have historically been office workers. Given the geographic scope of our business and operations, we are most exposed to issues within the U.S. economy and financial markets. Our foreign business activities continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business more than nominally. We are, however, susceptible to the risk that foreign economic conditions and geopolitical tensions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S. Throughout the remainder of this Risk Factors section, we address specific ways in which economic issues could create risk for us and result in adverse impacts on our business and financial performance.

As a financial services company, our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S. Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns and higher inflation and unemployment. This may be further exacerbated by the expiration of pandemic-related government assistance in the U.S., which could lead to a decrease in economic activity and a deterioration in households’ finances, particularly if consumers also continue to face high inflation. In addition, periods of inflation may affect certain of our costs or expenses (including increasing our cost of capital and labor), erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services. The PNC Financial Services Group, Inc. – 2022 Form 10-K 15 The PNC Financial Services Group, Inc. – 2022 Form 10-K 15 The PNC Financial Services Group, Inc. – 2022 Form 10-K 15 While the U.S. economy has generally improved since the onset of the COVID-19 pandemic, we now operate in an uncertain economic environment as a result of the impacts of the pandemic and responsive measures to manage it, high inflation, supply chain disruptions, changes in the labor markets, volatile energy prices and geopolitical tensions (including as a result of the Russia-Ukraine conflict). These conditions may not abate in the near term, and their continuation could materially adversely affect our operations and financial performance. Such economic conditions also have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally depending on the nature and severity of the adverse economic conditions. Even when economic conditions are relatively good or stable, specific economic factors can negatively affect our business and performance. This can be especially true when the factors relate to particular segments of the economy. For example, shifting consumer behavior with respect to retail purchases being made over the internet rather than in physical stores has negatively impacted performance by some retailers. This likely decreases demand for financial services in that sector, possibly harming the creditworthiness of some shopping mall operators, retail companies and others with whom we do business. As another example, we could experience an increase in credit losses as a result of structural and secular changes fostered by the pandemic for certain sectors of the economy. In addition, remote work has adversely affected and may continue to adversely affect commercial real estate, as well as businesses whose customers have historically been office workers. Affected companies have experienced and may continue to experience lower levels of business and possible declining creditworthiness. Given the geographic scope of our business and operations, we are most exposed to issues within the U.S. economy and financial markets. Our foreign business activities continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business more than nominally. We are, however, susceptible to the risk that foreign economic conditions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S. Throughout the remainder of this Risk Factors section, we address specific ways in which economic issues could create risk for us and result in adverse impacts on our business and financial performance.

The monetary policies of the Federal Reserve, including changes in the federal funds rate, open market operations and balance sheet management, have a significant impact on interest rates, the value of financial instruments and other assets and liabilities, and overall financial market performance and volatility. These policies can thus affect the activities and results of operations of financial companies such as PNC. An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments. Since 2022, the Federal Reserve’s quantitative tightening and increases in benchmark rates to reduce high rates of inflation has and may continue to adversely affect the value of financial instruments and other assets and liabilities, including securities and interest-bearing deposits, impact borrowers, increase market volatility and result in a flattening or inversion of the yield curve. In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above. Some of the potential impacts on our business and results of governmental monetary policy are described in Risk Factors under the heading “Risks Related to the Business of Banking.”

The monetary policies of the Federal Reserve, including changes in the federal funds rate, open market operations and balance sheet management, have a significant impact on interest rates, the value of financial instruments and other assets and liabilities, and overall financial market performance and volatility. These policies can thus affect the activities and results of operations of financial 16 The PNC Financial Services Group, Inc. – 2022 Form 10-K 16 The PNC Financial Services Group, Inc. – 2022 Form 10-K 16 The PNC Financial Services Group, Inc. – 2022 Form 10-K companies such as PNC. An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments. The FOMC has increased its benchmark rates from a range of 0% to 0.25% from March 2020 through 2021 to 4.75% as of February 1, 2023 in an effort to reduce high rates of inflation. Although we may not accurately predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results, we anticipate that the FOMC will increase the federal funds rate by an additional 25 basis points in March. This would bring the federal funds rate to a range of 4.75% to 5.00% by mid-March. We expect a federal funds rate cut of 25 basis points in early 2024 as inflation moves toward the FOMC’s 2% long-term objective. In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above. Some of the potential impacts on our business and results of governmental monetary policy are described in Risk Factors under the heading “Risks Related to the Business of Banking.”

Acquisitions of other companies or of financial assets and deposits and other liabilities present risks and uncertainties to us in addition to those presented by the nature of the business acquired, which may materially and adversely affect our results of operations. Many of the same risks arise when we engage in strategic partnerships. Our ability to analyze the risks presented by prospective acquisitions, as well as our ability to prepare in advance of closing for integration, may be limited to the extent that we cannot gather necessary or desirable information with respect to the business we are acquiring. We may also make certain assumptions related to an acquisition that may prove to be inaccurate that limit the anticipated benefits (such as cost savings from synergies or strategic gains from being 30 The PNC Financial Services Group, Inc. – 2023 Form 10-K 30 The PNC Financial Services Group, Inc. – 2023 Form 10-K 30 The PNC Financial Services Group, Inc. – 2023 Form 10-K able to offer enhanced product sets) or make the acquisition more expensive or take longer to complete and integrate than anticipated. Prior to closing an acquisition, prospective acquisition targets are also subject to their own risks that we cannot manage or control. Our ability to complete an acquisition may be dependent on regulatory agencies with responsibilities for reviewing or approving the transaction, which could delay, restrictively condition or result in denial of an acquisition, or otherwise limit the benefits of the acquisition. Changes in regulatory rules or standards or the application of those rules or standards, or future regulatory initiatives designed to promote competition or limit systemic risk and the potential for a financial institution to become “too big to fail,” may also limit our ability to complete an acquisition. Acquisition targets have their own risks specific to their businesses that could impact the success of an acquisition and its integration into PNC, such as: •If a significant aspect of the value of transaction is intellectual property, the extent to which the intellectual property may be utilized or protected and commercialized by PNC. •If the acquisition includes loan portfolios, the extent of actual credit losses and the required allowance for credit losses following completion of the acquisition. •If the acquisition involves entering into new businesses or geographic or other markets, potential limitations on our ability to take advantage of these opportunities because of our inexperience with respect to them. •The results of litigation and governmental investigations that may be pending at the time of the acquisition or that may be filed or commenced thereafter, because of an acquisition or otherwise, which are often hard to predict. •Operational or compliance issues at the acquisition target may not be fully identified or remediated until after the acquisition closes, potentially resulting in increased costs or penalties. •Models used by an acquisition target, such as for capital planning and credit loss accounting, may be designed or implemented in a manner different than at PNC, and our necessary reliance on these for a period of time, could materially impact our financial condition or results of operations to the extent that our estimates based on these models are inaccurate. •Enterprise risk management systems, policies and procedures may be different and less mature than those of PNC, and our necessary reliance on these for a period of time, could limit PNC’s ability to identify, monitor, manage and report risks or subject us to heightened regulatory, legal, operational or reputational risk. After closing, the success of an acquisition is likely partially dependent on our ability to retain and expand upon the acquired company’s customer base. It is also frequently subject to risks related to human capital, including, risks related to integrating the corporate culture of the acquired company and, to the extent being retained, the quality of leadership of the acquired company.

Acquisitions of other companies or of financial assets and deposits and other liabilities present risks and uncertainties to us in addition to those presented by the nature of the business acquired. Many of the same risks arise when we engage in strategic partnerships. Specific factors that can affect the ultimate results from acquisitions include, depending on the nature of the business acquired, the following: •Diligence risk: Our ability to analyze the risks presented by prospective acquisitions, as well as our ability to prepare in advance of closing for integration, depends, in part, on the information we can gather with respect to the business we are acquiring. We may not have access to all of the information that would be desirable. Our pre-acquisition review of the business also impacts our ability to prepare for and execute on the integration of an acquired business. •Accuracy of assumptions: We make certain assumptions related to an acquisition that may prove to be inaccurate. Anticipated benefits (such as cost savings from synergies or strategic gains from being able to offer enhanced product sets) may take longer or require greater resources to achieve or may not be achieved in their entirety. Acquisitions also may be substantially more expensive or take longer to complete than anticipated. We may also incur unanticipated costs in connection with the integration of an acquired business. •Regulatory approval: Completing attractive acquisition opportunities generally requires various governmental and regulatory approvals and consents prior to closing. These authorities have broad discretion, and regulatory approvals could be delayed, restrictively conditioned or denied, including due to regulatory issues we (or the target company) have, or may have, under any of the numerous governmental regulations to which we (or it) are subject. Moreover, as a condition to approval, governmental authorities may impose requirements, require divestitures or place restrictions on the conduct of the business of the combined company, which could limit the benefits of the acquisition or result in delay or the failure to close the acquisition. Significant acquisitions by large banks also often attract public scrutiny, which may result in negative publicity that adversely affects our reputation. Our ability to make large acquisitions may be limited by the regulatory agencies responsible for reviewing or approving the transaction, changes in regulatory rules or standards or the application of those rules or standards, or future regulatory initiatives designed to limit systemic risk and the potential for a financial institution to become “too big to fail.” •Pre-closing risk: Prospective acquisition targets are also subject to their own risks that we cannot manage or control prior to closing. As a result, our business, financial condition, results of operations and cash flows could be adversely affected after closing to the extent that any such risks result in non-indemnified losses for which we are responsible. •Target-specific risk: Acquisition targets have their own risks specific to their businesses that could impact the success of a transaction. •If a significant aspect of the value of transaction is intellectual property, the extent to which the intellectual property may be utilized or protected and commercialized by PNC. •If the acquisition includes loan portfolios, the extent of actual credit losses and the required allowance for credit losses following completion of the acquisition. •If the acquisition involves entering into new businesses or geographic or other markets, potential limitations on our ability to take advantage of these opportunities because of our inexperience with respect to them. •The results of litigation and governmental investigations that may be pending at the time of the acquisition or that may be filed or commenced thereafter, because of an acquisition or otherwise. It is often hard to predict the results of such legal proceedings. It may also be hard to anticipate what legal proceedings may be started following an acquisition based on the prior activities of the acquired company (and its predecessors). •If the acquired company depends on models for, among other things, capital planning and credit loss accounting, we may have to rely on the acquired company’s models post-closing prior to integrating the acquired company’s data into PNC’s models. These models may be designed or implemented in a manner different than the models used by PNC. As a result, incorporation of the acquired company’s data into our models could materially impact our results of operations or financial position to the extent that our estimates based on the acquired company’s models prove to be inaccurate. •The acquired company may operate under enterprise risk management systems, policies and procedures that are different and less mature than those of PNC, and we may need to rely on the acquired company’s enterprise risk management systems, policies and procedures for a period of time after acquisition, which might limit PNC’s ability to identify, monitor, manage and report risks. The acquired company may also implement its policies and procedures in a different manner than PNC would, which may result in heightened regulatory, legal, operational or reputational risk. •Retention risk: The success of an acquisition generally is at least partially dependent on our ability to retain and expand upon the acquired company’s customer base. It is also frequently subject to risks related to human capital, including, to the extent being retained, the quality of leadership of the acquired company. •Integration risk: Successful integration of an acquired company may present challenges due to differences in policies, procedures and systems, the level of details or comprehensiveness of an acquired company’s financial and business information and data, and corporate culture. Integration challenges could also result in damage to our reputation, as described under “We are at risk for an adverse impact on our business due to damage to our reputation.” 30 The PNC Financial Services Group, Inc. – 2022 Form 10-K 30 The PNC Financial Services Group, Inc. – 2022 Form 10-K 30 The PNC Financial Services Group, Inc. – 2022 Form 10-K

We use financial and statistical models throughout many areas of our business, relying on them to inform decision making, automate processes, and estimate many financial values. We increasingly use models related to how we do business with customers and for internal process automation that leverage AI/machine learning algorithms. These models can be more predictive, but because of the complex way in which the many variables in AI/machine learning models interact, the results of these models are often less interpretable than traditional statistical models. Examples of model uses include determining the pricing of various products, identifying potentially fraudulent or suspicious transactions, marketing to potential customers, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements. Models generally predict or infer certain financial outcomes, leveraging historical data and assumptions as to the future, often with respect to macroeconomic conditions. Development and implementation of some of these models, such as the models for credit loss accounting under CECL, require us to make difficult, subjective and complex judgments. Other models are used to support decisions made regarding how we do business with customers. Poorly designed or implemented models present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. For example, our models may not be effective if historical data does not accurately represent future events or environments or if our models rely on erroneous data, formulas, algorithms or assumptions and our internal model review processes fail to detect and address these flaws. Models, if flawed, could cause information we provide to the public or to our regulators to be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models we use is insufficient. Finally, flaws in our models that negatively impact our customers or our ability to comply with applicable laws and regulations could negatively affect our reputation or result in fines and penalties from our regulators.

We rely on models to measure risks and to estimate many financial values. We use models throughout many areas of our business, relying on them to inform decision making. Examples of areas where we use models include determining the pricing of various products, identifying potentially fraudulent transactions, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements. Models generally predict or infer certain financial outcomes, leveraging historical data and assumptions as to the future, often with respect to macroeconomic conditions. Development and implementation of some of these models, such as the models for credit loss accounting under CECL, require us to make difficult, subjective and complex judgments. Poorly designed or implemented models, including in the choice of relevant historical data or forward-looking assumptions, present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. For example, our models may not be effective if historical data does not accurately represent future events or environments or if our models rely on erroneous data, formulas, algorithms or assumptions and our internal model review processes fail to detect and address these flaws. Models, if flawed, could cause information we provide to the public or to our regulators to be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models we use is insufficient. Finally, flaws in our models that negatively 26 The PNC Financial Services Group, Inc. – 2022 Form 10-K 26 The PNC Financial Services Group, Inc. – 2022 Form 10-K 26 The PNC Financial Services Group, Inc. – 2022 Form 10-K impact our customers or our ability to comply with applicable laws and regulations could negatively affect our reputation or result in fines and penalties from our regulators.