Truist Financial Corporation: 10-K Risk Factor Changes

Truist is subject to extensive and evolving government regulation and supervision, which could adversely affect our business, financial condition, results of operations, and prospects. The banking and financial services industries are highly regulated. Truist is subject to supervision, regulation, and examination by regulators, including the FRB, FDIC, NCCOB, SEC, CFTC, CFPB, FINRA, MSRB, NFA, and various other federal and state regulatory agencies. The regulatory and supervisory framework applicable to banking organizations is intended primarily for the protection of depositors and other clients, the DIF, the broader economy, and the stability of the U.S. financial system, rather than for the protection of shareholders and non-deposit creditors. In addition to banking laws and regulations, Truist is subject to various other laws and regulations, all of which directly or indirectly affect the operations and management of Truist and its ability to make distributions to shareholders. Truist is also subject to heightened requirements under the enhanced prudential standards and expects increased supervisory scrutiny, including, for example, single counterparty credit limits, heightened expectations with respect to governance, risk management and internal controls and additional capital and liquidity requirements. Reform of the financial services industry resulting from the Dodd-Frank Act, including the EGRRCPA and other legislative and regulatory changes, affect the Company’s operations. These compliance risks relate to a wide variety of laws, rules, and regulations varying across Truist’s lines of business, corporate functions, and jurisdictions, and include risks related to financial products and services, relationships and interactions with clients, and teammate activities. Compliance risks include those associated with anti-money laundering compliance, trading activities, market conduct, and the laws, rules, and regulations related to the offering of products and services across jurisdictional borders. Compliance risk is also inherent in Truist’s fiduciary activities, including the failure to exercise the applicable standard of care to act in the best interest of fiduciary clients or to treat fiduciary clients fairly. These laws and regulations and Truist’s inability to act in certain instances without receiving prior regulatory approval affect Truist’s lending practices, capital structure, investment practices, dividend policy, ability to repurchase common stock and ability to pursue strategic acquisitions, among other activities. Changes to statutes, regulations or regulatory policies or their interpretation or implementation and the continued heightening of regulatory requirements could affect Truist in substantial and unpredictable ways. Federal and state banking regulators also possess broad powers to take supervisory actions as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums, higher compliance expenses, and limitations on the Company’s activities that could have an adverse effect on operations or profitability. 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation Truist has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities beyond banking, including securities, advisory, insurance, and merchant-banking activities. Truist and Truist Bank are subject to ongoing requirements for Truist to qualify as an FHC. If a BHC or any of its insured depository institutions were found not to be well capitalized or well managed, as defined under applicable law, the BHC can be restricted from engaging in the broader range of financial and related activities permitted for FHCs, including the ability to acquire companies engaged in those activities, and can be required to discontinue these activities or even divest any of its insured depository institutions. In addition, if an insured-depository-institution subsidiary of a BHC were to fail to achieve a satisfactory or better rating under the CRA, the ability of the BHC to expand its financial and related activities or make acquisitions could be restricted. Financial regulators’ prudential and supervisory authority gives them broad power and discretion to direct Truist’s actions, and they have assumed an active oversight, examination, and enforcement role across the financial services industry on both the federal and state levels. Areas of focus in the recent past have been with respect to climate, deposits, interest-rate risk management, commercial real estate, risk governance and controls, capital, liquidity, long-term debt requirements, mortgage-related practices, auto lending practices, complaints management, sales practices and related incentive compensation programs, data privacy, data protection, cybersecurity, fair banking, overdraft and other fees, retention and recordkeeping of electronic communications, and other compliance matters. Truist continues to be subject to examinations and ongoing monitoring to assess compliance with BSA/AML and OFAC laws and regulations. These laws and regulations are designed to protect the financial system, consumers and financial institutions from bad actors and illicit activities by requiring financial institutions to develop and implement BSA/AML programs designed to deter and when possible detect and prevent the use of the financial system to facilitate the funding of criminal activities. In addition, Truist is also prohibited from engaging in financial transactions with certain individuals, entities, and countries under programs administered by the OFAC of the U.S. Treasury. Additionally, actual or alleged misconduct by teammates, including unethical, fraudulent, improper, or illegal conduct, or unfair, deceptive, abusive, or discriminatory practices, can result in litigation, or government investigations and enforcement actions, and cause significant reputational harm to Truist, even if allegations are ultimately unsubstantiated. The Company and other large financial institutions have become subject to increased scrutiny, more intense supervision and regulation, and more supervisory findings and actions, with increased operational costs, as well as impacts on geographic expansion and acquisitions, which we expect to continue. The financial services industry also continues to face a stricter and more aggressive enforcement of laws at federal, state, and local levels—particularly in connection with business and other practices that may harm or appear to harm consumers or affect the financial system more broadly. Financial institutions often are less inclined to litigate with governmental authorities because of the regulatory and supervisory framework. Truist expects that its businesses will remain subject to extensive regulation and supervision. Any potential new regulations or modifications to existing regulations would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure. Our regulatory and supervisory environments, whether at federal, state, or local levels, are not static. No assurance can be given that applicable statutes, regulations, and other laws will not be amended or construed differently, that new laws will not be adopted, or that any of these laws will not be enforced more aggressively. Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated in the U.S. or abroad, including policies and rulemaking related to the Dodd-Frank Act, limits on acquisitions, more stringent capital and liquidity requirements, policies and rulemaking related to emerging technologies, cybersecurity and data, and climate risk management and ESG governance and reporting, including emissions and sustainability disclosure. In addition, concerns over climate change may prompt changes in regulations that, in turn, could have an adverse impact on asset values and the financial performance of Truist’s businesses and its clients. The cumulative effect of such legislation and regulations on Truist’s business, operations, and profitability cannot be accurately predicted. Such regulatory changes may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs and increase the ability of non-banks to offer competing financial services and products. Further, our noncompliance with applicable laws, whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent, can result in the suspension or revocation of licenses or registrations that we need to operate and in the initiation of enforcement and other supervisory actions or private litigation. Truist also relies upon third parties who may expose the Company to compliance and legal risk. New or existing legal requirements also could heighten the reputational impact of perceived misuses of client data by the Company and third parties. See additional disclosures in the “Regulatory Considerations” section in Item 1 “Business.” Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Regulatory capital and liquidity standards and future revisions to them may negatively impact our business and financial results. Truist is subject to regulatory capital and liquidity requirements established by the FRB and the FDIC. These regulatory capital and liquidity requirements are typically developed at an international level by the BCBS and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies have the ability to apply stricter capital and liquidity standards than those developed by the BCBS. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations. Requirements to maintain specified levels of capital and liquidity and regulatory expectations as to the quality of the Company’s capital and liquidity may prevent the Company from taking advantage of opportunities in the best interest of shareholders or force the Company to take actions contrary to their interests. For example, Truist may be limited in its ability to pay or increase dividends or otherwise return capital to shareholders. In addition, these requirements may impact the amount and type of loans the Company is able to make. Truist may be constrained in its ability to expand, either organically or through mergers and acquisitions. These requirements may cause the Company to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require the Company to maintain holdings of highly liquid investments, thereby reducing the Company’s ability to invest in less liquid assets, even if more desirable from a balance sheet return or interest rate risk management perspective. As a Category III banking organization, Truist is subject to additional capital and liquidity requirements. For example, Truist is subject to a requirement to submit capital plans to the Federal Reserve for review that include, among other things, projected dividend payments and repurchases of capital stock. As part of the capital planning and stress testing processes, our capital actions are assessed against our ability to satisfy applicable capital requirements in the event of a stressed market environment. If we fail to satisfy applicable capital requirements, including the SCB, our ability to undertake capital actions may be restricted. The liquidity standards applicable to large U.S. banking organizations have been supplemented in recent years. The NSFR rule, which is designed to ensure that banking organizations maintain a stable funding profile in relation to their asset composition and off-balance sheet activities, became effective on July 1, 2021. Public disclosure of the NSFR began in 2023. In addition to the regulatory capital and liquidity requirements applicable to Truist and Truist Bank, the Company’s broker-dealer subsidiaries are subject to capital requirements established by the SEC. Regulatory capital and liquidity requirements receive periodic review and revision by the BCBS and the U.S. banking agencies. Proposed changes to applicable capital and liquidity requirements, such as the Basel III proposal and the long-term debt proposal, could result in increased expenses or cost of funding, which could negatively affect our financial results or our ability to pay dividends and engage in share repurchases. For more information concerning our legal and regulatory obligations with respect to Basel III and long-term debt requirements, please see “Regulatory Considerations” in Item 1 “Business.” Truist is subject to risks related to originating and selling loans, including repurchase and indemnification obligations. When loans are sold or securitized, it is customary to make representations and warranties to the purchaser about the loans, including the manner in which they were originated. These agreements generally require the repurchase of loans or indemnification in the event of a breach of these representations or warranties. An increase in the number of repurchase and indemnity demands from purchasers related to representations and warranties on sold loans could result in an increase in the amount of losses for loan repurchases. Truist also bears a risk of loss from borrower defaults for multi-family commercial mortgage loans sold to FNMA. In addition to repurchase claims from GSEs, Truist could be subject to indemnification claims from non-GSE purchasers of the Company’s mortgage loans. Claims could be made if the loans sold fail to conform to statements about their quality, the manner in which the loans were originated and underwritten or their compliance with state and federal law. Additional factors affecting the extent to which we may securitize loans and receivables in the future include the overall credit quality of our loans and receivables, the costs of securitizing our loans and receivables, the demand for consumer asset-backed securities and the legal, regulatory, accounting or tax rules affecting securitization transactions and asset-backed securities, generally. 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation Truist faces risks as a servicer of loans. The Company acts as servicer for a range of assets and products and primarily for loans in securitizations and unsecuritized loans owned by investors. As servicer for loans, the Company has certain contractual obligations to the securitization trusts, investors, or other third parties. As a servicer, Truist’s obligations include foreclosing on defaulted loans or, to the extent consistent with the applicable securitization or other investor agreement, considering alternatives to foreclosure such as loan modifications or short sales. Generally, the Company’s servicing obligations are set by contract, for which the Company receives a contractual fee. However, GSEs can amend their servicing guidelines unilaterally for certain government guaranteed mortgages, which can increase the scope or costs of the services required without any corresponding increase in the Company’s servicing fee. Further, the CFPB has implemented national servicing standards, which have increased the scope and cost of services that the Company is required to perform. In addition, there has been a significant increase in state laws that impose additional servicing requirements that increase the scope and cost of the Company’s servicing obligations. As a servicer, the Company also advances expenses on behalf of investors, which it may be unable to collect. A material breach of the Company’s obligations as servicer may result in contract termination if the breach is not cured within a specified period of time following notice, which can generally be given by the securitization trustee or a specified percentage of security holders, causing the Company to lose servicing income. In addition, the Company may be required to indemnify the securitization trustee against losses from any failure by the Company, as a servicer, to perform the Company’s servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain investors and certain transactions, Truist may be contractually obligated to repurchase a loan or reimburse the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. The Company may be subject to increased repurchase obligations as a result of claims made that the Company did not satisfy its obligations as a servicer. The Company may also experience increased loss severity on repurchases, which may require a material increase to the Company’s repurchase reserve. The Company has and may continue to receive indemnification requests related to the Company’s servicing of loans owned or insured by other parties, primarily GSEs. Typically, such a claim seeks to impose a compensatory fee on the Company for departures from GSE service levels. In most cases, this is related to delays in the foreclosure process. Additionally, the Company has received indemnification requests where an investor or insurer has suffered a loss due to a breach of the servicing agreement. While the number of such claims has been small, these could increase in the future. Truist faces substantial risks in safeguarding personal and other sensitive information. Truist’s businesses are subject to complex and evolving laws, rules, and regulations governing data privacy, data protection, and cybersecurity, particularly with respect to the privacy and protection of personal information of individuals. Individuals whose personal information may be protected by law can include the Company’s clients (and in some cases its clients’ clients), prospective clients, job applicants, teammates, and the employees of the Company’s vendors, and other third parties. Complying with the laws, rules, and regulations applicable to the Company’s disclosure, collection, use, sharing, storage, and other processing of personal information can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by the Company or a third-party affiliated with the Company could expose the Company to litigation or regulatory fines, penalties, or other sanctions. Additional risks could arise from the failure of the Company or third parties to provide adequate disclosure or transparency to the Company’s clients about the personal information collected from them and the use of such information; to receive, document, and honor the privacy preferences expressed by the Company’s clients; to protect personal information from unauthorized disclosure; or to maintain proper training on data privacy, data protection, or cybersecurity practices for all teammates or third parties who have access to personal information. Concerns regarding the effectiveness of Truist’s measures to safeguard personal information, or even the perception that those measures are inadequate, could cause Truist to lose existing or potential clients, and thereby reduce Truist’s revenues. Furthermore, any failure or perceived failure by the Company to comply with applicable data privacy, data protection, or cybersecurity laws, rules, or regulations may subject it to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices, significant liabilities or regulatory fines, penalties, or other sanctions. Any of these could damage Truist’s reputation and otherwise adversely affect its businesses. Truist Financial Corporation 33 Truist Financial Corporation 33 Truist Financial Corporation 33 Truist Financial Corporation 33 Truist Financial Corporation 33 Truist Financial Corporation 33 In recent years, well-publicized incidents involving the inappropriate disclosure, collection, use, sharing, storage, and other processing of personal information have led to expanded governmental scrutiny of practices relating to the safeguarding of personal information by companies. That scrutiny has in some cases resulted in, and could in the future lead to, the adoption of stricter laws, rules and regulations relating to the disclosure, collection, use, sharing, storage, and other processing of personal information. Truist will likely be subject to new and evolving data privacy, data protection, and cybersecurity laws, rules and regulations in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines, and enforcement actions. These types of laws, rules and regulations could prohibit or significantly restrict financial services firms such as Truist from sharing information among affiliates or with third parties such as vendors, and thereby increase compliance costs, or could restrict Truist’s use of personal information when developing or offering products or services to clients. These restrictions could also inhibit Truist’s development or marketing of certain products or services or increase the costs of offering them to clients. For more information concerning our legal and regulatory obligations with respect to data privacy, data protection, and cybersecurity, please see “Privacy, Data Protection, and Cybersecurity” in Item 1 “Business.” Differences in regulation and supervision can affect the Company’s ability to compete effectively. The content and application of laws and regulations affecting financial services firms sometimes vary according to factors such as the size of the firm, the jurisdiction in which it is organized or operates, and other criteria. Large institutions, such as the Company, often are subject to more stringent regulatory requirements and supervision than smaller institutions. In addition, financial technology companies and other non-traditional competitors may not be subject to banking regulation or may be supervised by a national or state regulatory agency that does not have the same regulatory priorities or supervisory requirements as the Company’s regulators. These differences in regulation can impair the Company’s ability to compete effectively with competitors that are less regulated and do not have similar compliance costs. The Company can face risks of non-compliance and incur additional operational and compliance costs under laws relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption. Truist must comply with laws and regulations relating to anti-money laundering, economic sanctions, embargo programs and anti-corruption, which can increase its risks of non-compliance and costs associated with the implementation and maintenance of complex compliance programs. A violation of any of these legal and regulatory requirements could subject Truist or individual employees to regulatory enforcement actions as well as significant civil and criminal penalties.

Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions. The banking and financial services industries are highly regulated. Truist is subject to supervision, regulation, and examination by regulators, including the FRB, FDIC, NCCOB, SEC, CFTC, CFPB, FINRA, NFA, and various other federal and state regulatory agencies. The statutory and regulatory framework governing Truist is generally intended to protect depositors, the DIF, clients, and the U.S. financial system as a whole, and not Truist’s debt holders or shareholders. Truist is also subject to heightened requirements under the enhanced prudential standards and expects increased supervisory scrutiny, including, for example, single counterparty credit limits, heightened expectations with respect to governance, risk management and internal controls and additional capital and liquidity requirements. Reform of the financial services industry resulting from the Dodd-Frank Act, including the EGRRCPA and other legislative, regulatory, and technological changes, affect the Company’s operations. Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 These laws and regulations and Truist’s inability to act in certain instances without receiving prior regulatory approval affect Truist’s lending practices, capital structure, investment practices, dividend policy, ability to repurchase common stock and ability to pursue strategic acquisitions, among other activities. Changes to statutes, regulations or regulatory policies or their interpretation or implementation and the continued heightening of regulatory requirements could affect Truist in substantial and unpredictable ways. Federal and state banking regulators also possess broad powers to take supervisory actions as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums, higher compliance expenses, and limitations on the Company’s activities that could have a material adverse effect on operations or profitability. In recent years, both Congress and the federal banking regulators have engaged in a rebalancing of the post financial crisis legal and regulatory framework, particularly by tailoring enhanced prudential standards to the size, risk profile, and complexity of the banking organization. Under the current presidential administration and Congress, the Company and other large financial institutions are becoming subject to increased scrutiny, more intense supervision and regulation, and a higher risk of enforcement action, with increased fines and penalties which we expect to continue. Truist expects that its businesses will remain subject to extensive regulation and supervision. Any potential new regulations or modifications to existing regulations would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure. Compliance with new regulations and supervisory initiatives may increase costs. In addition, concerns over climate change may prompt changes in regulations that, in turn, could have a material adverse impact on asset values and the financial performance of Truist’s businesses and its clients. Financial regulators’ prudential and supervisory authority gives them broad power and discretion to direct Truist’s actions, and they have assumed an active oversight, examination, and enforcement role across the financial services industry on both the federal and state levels. Areas of focus in the recent past have been with respect to mortgage-related practices, student lending practices, auto lending practices, complaints management, sales practices and related incentive compensation programs, consumer privacy, fair banking, overdraft and other fees, retention and recordkeeping of electronic communications, and other consumer compliance matters. Truist continues to be subject to examinations and ongoing monitoring to assess compliance with BSA/AML laws and regulations, as well as sanctions compliance administered by the OFAC. Additionally, actual or alleged misconduct by teammates, including unethical, fraudulent, improper, or illegal conduct, or unfair, deceptive, abusive, or discriminatory practices, can result in litigation, or government investigations and enforcement actions, and cause significant reputational harm, even if ultimately unsubstantiated. Truist also relies upon third parties who may expose the Company to compliance and legal risk. New or existing legal requirements also could heighten the reputational impact of perceived misuses of customer data by the Company and third parties. See additional disclosures in the “Regulatory Considerations” section. Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated, including policies and rulemaking related to the Dodd-Frank Act, limits on acquisitions, and more stringent capital and liquidity requirements. The cumulative effect of such legislation and regulations on Truist’s’ business, operations, and profitability cannot be accurately predicted. Such regulatory changes may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs should it fail to appropriately comply with new or modified laws and regulatory requirements and increase the ability of non-banks to offer competing financial services and products. Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders. Truist is subject to regulatory capital and liquidity requirements established by the FRB and the FDIC. These regulatory capital and liquidity requirements are typically developed at an international level by the BCBS and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies have the ability to apply stricter capital and liquidity standards than those developed by the BCBS. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations. Requirements to maintain specified levels of capital and liquidity and regulatory expectations as to the quality of the Company’s capital and liquidity may prevent the Company from taking advantage of opportunities in the best interest of shareholders or force the Company to take actions contrary to their interests. For example, Truist may be limited in its ability to pay or increase dividends or otherwise return capital to shareholders. In addition, these requirements may impact the amount and type of loans the Company is able to make. Truist may be constrained in its ability to expand, either organically or through mergers and acquisitions. These requirements may cause the Company to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require the Company to maintain holdings of highly liquid investments, thereby reducing the Company’s ability to invest in less liquid assets, even if more desirable from a balance sheet return or interest rate risk management perspective. As a Category III banking organization, Truist is subject to additional capital and liquidity requirements. 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation The liquidity standards applicable to large U.S. banking organizations have been supplemented in recent years. The NSFR rule, which is designed to ensure that banking organizations maintain a stable funding profile in relation to their asset composition and off-balance sheet activities, became effective on July 1, 2021. Public disclosure of the NSFR will begin in 2023. In addition to the regulatory capital and liquidity requirements applicable to Truist and Truist Bank, the Company’s broker-dealer subsidiaries are subject to capital requirements established by the SEC. Regulatory capital and liquidity requirements receive periodic review and revision by the BCBS and the U.S. banking agencies. Changes to capital and liquidity requirements may require Truist or Truist Bank to maintain more or higher quality capital or greater liquidity and could increase some of the potential adverse effects described above. Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers. Truist is required to make customary representations and warranties to the purchaser about the mortgage loans and the manner in which they were originated when selling mortgage loans or loan securitizations. An increase in the number of repurchase and indemnity demands from purchasers related to representations and warranties on loans sold could result in an increase in the amount of losses for loan repurchases. Truist also bears a risk of loss from borrower defaults for multi-family commercial mortgage loans sold to FNMA. In addition to repurchase claims from GSEs, Truist could be subject to indemnification claims from non-GSE purchasers of the Company’s loans. Claims could be made if the loans sold fail to conform to statements about their quality, the manner in which the loans were originated and underwritten or their compliance with state and federal law. Truist faces risks as a servicer of loans. The Company acts as servicer and master servicer for mortgage loans included in securitizations and for unsecuritized mortgage loans owned by investors. As a servicer or master servicer for those loans, the Company has certain contractual obligations to the securitization trusts, investors, or other third parties. As a servicer, Truist’s obligations include foreclosing on defaulted mortgage loans or, to the extent consistent with the applicable securitization or other investor agreement, considering alternatives to foreclosure such as loan modifications or short sales. In the Company’s capacity as a master servicer, obligations include overseeing the servicing of mortgage loans by the servicer. Generally, the Company’s servicing obligations are set by contract, for which the Company receives a contractual fee. However, GSEs can amend their servicing guidelines unilaterally, which can increase the scope or costs of the services required without any corresponding increase in the Company’s servicing fee. Further, the CFPB has implemented national servicing standards, which have increased the scope and cost of services that the Company is required to perform. In addition, there has been a significant increase in state laws that impose additional servicing requirements that increase the scope and cost of the Company’s servicing obligations. As a servicer, the Company also advances expenses on behalf of investors, which it may be unable to collect. A material breach of the Company’s obligations as servicer or master servicer may result in contract termination if the breach is not cured within a specified period of time following notice, which can generally be given by the securitization trustee or a specified percentage of security holders, causing the Company to lose servicing income. In addition, the Company may be required to indemnify the securitization trustee against losses from any failure by the Company, as a servicer or master servicer, to perform the Company’s servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain investors and certain transactions, Truist may be contractually obligated to repurchase a mortgage loan or reimburse the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. The Company may be subject to increased repurchase obligations as a result of claims made that the Company did not satisfy its obligations as a servicer or master servicer. The Company may also experience increased loss severity on repurchases, which may require a material increase to the Company’s repurchase reserve. The Company has and may continue to receive indemnification requests related to the Company’s servicing of loans owned or insured by other parties, primarily GSEs. Typically, such a claim seeks to impose a compensatory fee on the Company for departures from GSE service levels. In most cases, this is related to delays in the foreclosure process. Additionally, the Company has received indemnification requests where an investor or insurer has suffered a loss due to a breach of the servicing agreement. While the number of such claims has been small, these could increase in the future. Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist faces substantial legal and operational risks in safeguarding personal information. Truist’s businesses are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals. Individuals whose personal information may be protected by law can include the Company’s clients (and in some cases its clients’ clients), prospective clients, job applicants, teammates, and the employees of the Company’s vendors, and third parties. Complying with the laws, rules and regulations applicable to the Company’s disclosure, collection, use, sharing and storage of personal information can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by the Company or a third-party affiliated with the Company could expose the Company to litigation or regulatory fines, penalties or other sanctions. Additional risks could arise from the failure of the Company or third parties to provide adequate disclosure or transparency to the Company’s clients about the personal information collected from them and the use of such information; to receive, document, and honor the privacy preferences expressed by the Company’s clients; to protect personal information from unauthorized disclosure; or to maintain proper training on privacy practices for all teammates or third parties who have access to personal information. Concerns regarding the effectiveness of Truist’s measures to safeguard personal information, or even the perception that those measures are inadequate, could cause Truist to lose existing or potential clients, and thereby reduce Truist’s revenues. Furthermore, any failure or perceived failure by the Company to comply with applicable privacy or data protection laws, rules and regulations may subject it to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices, significant liabilities or regulatory fines, penalties or other sanctions. Any of these could damage Truist’s reputation and otherwise adversely affect its businesses. In recent years, well-publicized incidents involving the inappropriate collection, use, sharing or storage of personal information have led to expanded governmental scrutiny of practices relating to the safeguarding of personal information by companies. That scrutiny has in some cases resulted in, and could in the future lead to, the adoption of stricter laws, rules and regulations relating to the collection, use, sharing and storage of personal information. Truist will likely be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines, and enforcement actions. These types of laws, rules and regulations could prohibit or significantly restrict financial services firms such as Truist from sharing information among affiliates or with third parties such as vendors, and thereby increase compliance costs, or could restrict Truist’s use of personal data when developing or offering products or services to clients. These restrictions could also inhibit Truist’s development or marketing of certain products or services or increase the costs of offering them to clients. Differences in regulation can affect the Company’s ability to compete effectively. The content and application of laws and regulations affecting financial services firms sometimes vary according to factors such as the size of the firm, the jurisdiction in which it is organized or operates, and other criteria. Large institutions, such as the Company, often are subject to more stringent regulatory requirements and supervision than smaller institutions. In addition, financial technology companies and other non-traditional competitors may not be subject to banking regulation or may be supervised by a national or state regulatory agency that does not have the same regulatory priorities or supervisory requirements as the Company’s regulators. These differences in regulation can impair the Company’s ability to compete effectively with competitors that are less regulated and do not have similar compliance costs. The Company can face risks of non-compliance and incur higher operational and compliance costs under laws and regulations relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption. Truist must comply with laws and regulations relating to anti-money laundering, economic sanctions, embargo programs and anti-corruption, which can increase its risks of non-compliance and costs associated with the implementation and maintenance of complex compliance programs. A violation of any of these legal and regulatory requirements could subject Truist or individual employees to regulatory enforcement actions as well as significant civil and criminal penalties. 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation 30 Truist Financial Corporation

•Truist relies extensively on other companies to provide key components of the Company’s business infrastructure, and their failure to perform to our standards or other issues of concern with them could harm us. •The Company’s framework for managing risks and mitigating losses may not be effective. •In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist depends on the accuracy and completeness of information about clients and counterparties. •Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms. •Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures. The following discussion sets forth some of the more important risk factors that could materially affect Truist’s financial condition and operations. When a risk factor spans several risk categories, the risks have been listed by their primary risk category. The risks described are not all inclusive. Additional risks that are not presently known or risks deemed immaterial may have an adverse effect on Truist’s financial condition, results of operations, business, and prospects.

•Truist relies on other companies to provide key components of the Company’s business infrastructure. •The Company’s framework for managing risks may not be effective. •Truist depends on the accuracy and completeness of information about clients and counterparties. •Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms. •Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures. The following discussion sets forth some of the more important risk factors that could materially affect Truist’s financial condition and operations. When a risk factor spans several risk categories, the risks have been listed by their primary risk category. The risks described are not all inclusive. Additional risks that are not presently known or risks deemed immaterial may have a material adverse effect on Truist’s financial condition, results of operations, business, and prospects.

Our business and operations make extensive use of models, and we could be adversely affected if our design, implementation, or use of models is flawed. Truist relies on models to measure risks, estimate certain financial values, and inform certain business decisions. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items. 38 Truist Financial Corporation 38 Truist Financial Corporation 38 Truist Financial Corporation 38 Truist Financial Corporation 38 Truist Financial Corporation 38 Truist Financial Corporation Poorly designed, implemented, or incorrectly used models present the risk that certain Truist business decisions may be adversely affected by inappropriate model output. In addition, models based on historical data may degrade over time due to limited historical patterns, extreme or unanticipated market movements or client behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events). Also, information Truist provides to the public or to its regulators based on poorly designed, implemented, or incorrectly used models could be inaccurate or misleading. Certain decisions that the regulators make, including those related to capital distributions to Truist’s shareholders, could be adversely affected due to the perception of insufficient model quality or incorrect model use. We use estimates and assumptions in determining the value or amount of many of our assets and liabilities, and our business, financial condition, results of operations, and prospects could be adversely affected if these prove to be incorrect. Accounting policies and processes are fundamental to how the Company records and reports its financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the value of the Company’s assets or liabilities and financial results. Several of the Company’s accounting policies are critical because they require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If assumptions or estimates underlying the Company’s financial statements are incorrect or are adjusted periodically, the Company may experience material losses. Management has identified certain accounting policies as being critical because they require management’s judgment to ascertain the valuations of assets, liabilities, commitments, and contingencies. A variety of factors could affect the realization of income and expense or the recognition of assets and liabilities in the Company’s financial statements. Truist has established detailed policies and procedures that are intended to ensure these critical accounting estimates and judgments are well controlled and applied consistently. In addition, the policies and procedures are intended to ensure that the process for changing methodologies occurs in an appropriate manner. Due to the uncertainty surrounding the Company’s judgments and the estimates pertaining to these matters, the Company cannot guarantee that adjustments to accounting policies or restatement of prior period financial statements will not be required. Further, from time to time, the FASB and SEC change the financial accounting and reporting standards that govern the preparation of the Company’s financial statements. In addition, accounting standard setters and those who interpret the accounting standards may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond the Company’s control, can be hard to predict and could materially affect how the Company reports its financial results and condition. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements. Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill. Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. Based on the Company’s annual impairment test of goodwill, it was determined for the CB&W and C&CB reporting units that the respective reporting units’ carrying value was in excess of its respective fair value as of October 1, 2023, resulting in a $6.1 billion non-cash, non-tax-deductible goodwill impairment charge for the year ended December 31, 2023. Future adverse changes in economic conditions or expected financial performance may cause the fair value of a reporting unit to be below its carrying amount, resulting in an additional goodwill impairment charge. The estimated fair values of the individual reporting units are assessed for reasonableness by reviewing a variety of indicators, including comparing these estimated fair values to the Company’s market capitalization over a reasonable period of time. While this comparison provides some relative market information about the estimated fair value of the reporting units, it is not determinative and needs to be evaluated in the context of the current economic environment. However, significant and sustained declines in the Company’s market capitalization could be an indication of potential goodwill impairment. Refer to the “Critical Accounting Policies” section for additional details related to the Company’s intangible assets and goodwill. Truist Financial Corporation 39 Truist Financial Corporation 39 Truist Financial Corporation 39 Truist Financial Corporation 39 Truist Financial Corporation 39 Truist Financial Corporation 39

There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators. Truist relies on models to measure risks, estimate certain financial values, and inform certain business decisions. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items. Poorly designed, implemented, or incorrectly used models present the risk that certain Truist business decisions may be adversely affected by inappropriate model output. Also, information Truist provides to the public or to its regulators based on poorly designed, implemented, or incorrectly used models could be inaccurate or misleading. Certain decisions that the regulators make, including those related to capital distributions to Truist’s shareholders, could be adversely affected due to the perception of insufficient model quality or incorrect model use. The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain. Accounting policies and processes are fundamental to how the Company records and reports its financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the value of the Company’s assets or liabilities and financial results. Several of the Company’s accounting policies are critical because they require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If assumptions or estimates underlying the Company’s financial statements are incorrect or are adjusted periodically, the Company may experience material losses. 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation Management has identified certain accounting policies as being critical because they require management’s judgment to ascertain the valuations of assets, liabilities, commitments, and contingencies. A variety of factors could affect the realization of income and expense or the recognition of assets and liabilities in the Company’s financial statements. Truist has established detailed policies and procedures that are intended to ensure these critical accounting estimates and judgments are well controlled and applied consistently. In addition, the policies and procedures are intended to ensure that the process for changing methodologies occurs in an appropriate manner. Due to the uncertainty surrounding the Company’s judgments and the estimates pertaining to these matters, the Company cannot guarantee that adjustments to accounting policies or restatement of prior period financial statements will not be required. Further, from time to time, the FASB and SEC change the financial accounting and reporting standards that govern the preparation of the Company’s financial statements. In addition, accounting standard setters and those who interpret the accounting standards may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond the Company’s control, can be hard to predict and could materially affect how the Company reports its financial results and condition. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements. Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill. Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. Future adverse changes in economic conditions or expected financial performance may cause the fair value of a reporting unit to be below its carrying amount, resulting in goodwill impairment. The estimated fair values of the individual reporting units are assessed for reasonableness by reviewing a variety of indicators, including comparing these estimated fair values to the Company’s market capitalization over a reasonable period of time. While this comparison provides some relative market information about the estimated fair value of the reporting units, it is not determinative and needs to be evaluated in the context of the current economic environment. However, significant and sustained declines in the Company’s market capitalization could be an indication of potential goodwill impairment. Refer to the “Critical Accounting Policies” section for additional details related to the Company’s intangible assets policy.

The Company may incur damages, fines, penalties, and other negative consequences from past, current, or future regulatory or other legal violations, including inadvertent or unintentional violations. Truist maintains systems and procedures designed to ensure that it complies with applicable laws and regulations, but there can be no assurance that these will be effective. In addition to fines and penalties, the Company may suffer other negative consequences from regulatory violations including restrictions on certain activities and damage to the Company’s reputation, which in turn might adversely affect the Company’s business and results of operations. Federal and state law grants substantial enforcement powers to federal and state banking regulators and law enforcement agencies. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Any future enforcement action could have an adverse impact. In addition, governmental authorities have, at times, sought criminal penalties against companies in the financial services sector for violations, and, at times, have required an admission of wrongdoing, criminal pleas or other extraordinary terms from financial institutions in connection with resolving such matters. Criminal convictions or criminal pleas or admissions of wrongdoing in a settlement with the government can lead to greater exposure in civil litigation, reputational harm, and other significant collateral consequences such as restrictions on engaging in new activities or acquisitions, loss of clients, restrictions on the ability to access the capital markets and the inability to operate certain businesses or offer certain products for a period of time. Failures to comply with law, regulatory requirements, or supervisory expectations expose the Company to fines, regulatory penalties, significant remediation actions and other costs, reputational damage, civil litigation, restrictions on returning capital to shareholders through share repurchases or dividends, constraints on existing activities, and regulatory or enforcement actions which, in turn, frequently result in limitations on engaging in new activities, expanding geographically, or pursuing acquisitions or other growth opportunities and lead to higher operational and compliance costs. Violations of laws and regulations or deemed deficiencies in risk management, consumer compliance, or other practices also may be incorporated into Truist’s confidential supervisory ratings with associated adverse effects. 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation 34 Truist Financial Corporation Federal law grants substantial enforcement powers to federal financial institution regulators, OFAC and the U.S. Department of Justice, among other government agencies with respect to AML and OFAC laws and regulations. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or prohibition orders; and to initiate injunctive actions against financial institutions and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations or unsafe and unsound practices. Pending or threatened legal proceedings and other matters may adversely affect the Company’s business, financial condition, results of operations, and reputation. In the ordinary course of its business, the Company is subject to lawsuits, claims, and formal and informal enforcement activity, including regulatory investigations. The volume of legal proceedings against participants in the financial services industry, including the Company, is substantial, and enforcement actions by regulatory authorities are becoming more common in the current regulatory environment. Legal proceedings against financial services firms may increase depending on factors such as market downturn, changes in law and increased regulatory scrutiny. Heightened regulatory scrutiny or the results of an investigation or examination may lead to additional regulatory investigations or enforcement actions. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against Truist. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including Truist, and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements. Claims and legal actions, including class action lawsuits and enforcement proceedings, could involve large monetary amounts, significant defense costs, and result in settlements, judgments, penalties, fines, injunctions, or other forms of relief that are adverse to the Company. Responding to inquiries, investigations, lawsuits, and other proceedings is time-consuming and expensive and can divert senior management attention from Truist’s business. The outcome of any such legal proceedings, as well as the timing of any ultimate resolutions, may be difficult to predict or estimate. Actual legal and other costs arising from claims and legal actions may be greater than the Company’s legal accruals. Further, the Company may not have accruals for all legal proceedings where we face a risk of loss. The ultimate resolution of a pending legal proceeding or significant regulatory or government action against the Company could adversely affect the Company’s results of operations and financial condition or cause significant reputational harm, which may adversely impact the Company’s business prospects. Further, the Company may be exposed to substantial uninsured liabilities, which could adversely affect the Company’s results of operations and financial condition. Refer to the Legal Proceedings and Other Matters section in “Note 16. Commitments and Contingencies” for additional information.

The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations. Truist maintains systems and procedures designed to ensure that it complies with applicable laws and regulations, but there can be no assurance that these will be effective. In addition to fines and penalties, the Company may suffer other negative consequences from regulatory violations including restrictions on certain activities, such as the Company’s mortgage business, which may affect the Company’s relationship with the GSEs and may also damage the Company’s reputation and this in turn might materially affect the Company’s business and results of operations. Federal law grants substantial enforcement powers to federal banking regulators and law enforcement agencies. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Any future enforcement action could have a material adverse impact. In addition, governmental authorities have, at times, sought criminal penalties against companies in the financial services sector for violations, and, at times, have required an admission of wrongdoing from financial institutions in connection with resolving such matters. Criminal convictions or admissions of wrongdoing in a settlement with the government can lead to greater exposure in civil litigation, reputational harm, and other significant collateral consequences such as restrictions on engaging in new activities or acquisitions. A failure to comply with regulatory requirements and expectations could expose the Company to fines, regulatory penalties, other costs, reputational damage, civil litigation, and regulatory or enforcement actions which may, in turn, result in limitations on engaging in new activities or expanding geographically and lead to higher operational and compliance costs. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of settlements, which could have significant consequences for a financial institution, including loss of clients, restrictions on the ability to access the capital markets and the inability to operate certain businesses or offer certain products for a period of time. Violations of laws and regulations or deemed deficiencies in risk management practices also may be incorporated into Truist’s confidential supervisory ratings. A downgrade in these ratings, or these or other regulatory actions and settlements, could limit Truist’s ability to conduct expansionary activities for a period of time and require new or additional regulatory approvals before Truist can engage in certain other business activities. Further, some legal frameworks provide for the imposition of fines or penalties for noncompliance even when the noncompliance was inadvertent or unintentional and even when there were controls in place designed to ensure compliance. For example, Truist is subject to orders and regulations issued by OFAC that prohibit financial institutions from engaging with prohibited parties, including certain foreign governments, legal entities and individuals. OFAC has the authority to impose penalties for any violation of the prohibitions, whether the violation is intentional or unintentional, even if there were appropriate controls and Truist acted in good faith. Legal proceedings may adversely affect the Company’s results, reputation, and business operations. In the ordinary course of its business, the Company is subject to lawsuits, claims, and formal and informal enforcement activity, including regulatory investigations. The volume of legal proceedings against participants in the financial services industry, including the Company, is substantial, and enforcement actions by regulatory authorities are becoming more common in the current regulatory environment. Legal proceedings against financial services firms may increase depending on factors such as market downturn, changes in law and increased regulatory scrutiny. 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation 32 Truist Financial Corporation Heightened regulatory scrutiny or the results of an investigation or examination may lead to additional regulatory investigations or enforcement actions. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against Truist. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including Truist, and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements. Claims and legal actions, including class action lawsuits and enforcement proceedings, could involve large monetary amounts, significant defense costs, and result in settlements, judgments, penalties, fines, injunctions, or other forms of relief that are adverse to the Company. Responding to inquiries, investigations, lawsuits, and other proceedings is time-consuming and expensive and can divert senior management attention from Truist’s business. The outcome of any such legal proceedings, as well as the timing of any ultimate resolutions, may be difficult to predict or estimate. Actual legal and other costs arising from claims and legal actions may be greater than the Company’s legal accruals. Further, the Company may not have accruals for all legal proceedings where we face a risk of loss where the loss cannot be reasonably estimated. The ultimate resolution of a pending legal proceeding or significant regulatory or government action against the Company could materially adversely affect the Company’s results of operations and financial condition or cause significant reputational harm, which may adversely impact the Company’s business prospects. Further, the Company may be exposed to substantial uninsured liabilities, which could adversely affect the Company’s results of operations and financial condition.

The Company and its suppliers face a wide array of cybersecurity risks, including risks of insider threats and third-party cybersecurity incidents, which could result in the loss of operational capabilities or the disclosure of confidential, proprietary, personal, and other sensitive information, which could have an adverse impact on the Company’s operations, financial condition, and prospects, as well as cause significant reputational damage and legal and financial exposure. The Company’s computer systems and network infrastructure and those of third parties are targeted in cyberattacks and vulnerable to damage or interruption from, among other things, software bugs, server malfunctions, software or hardware failure, human error, fraud, denial of service attacks, social engineering schemes (such as phishing), hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities, or identity theft. The Company’s business relies on the secure collection, transmission, storage, use, retrieval, and other processing of confidential, proprietary, and other sensitive information in the Company’s information systems, networks and those of third parties. In addition, to access the Company’s systems, networks, products, and services, the Company’s clients and other third parties may use personal mobile devices or computing devices that are outside of the Company’s control and network environment and can introduce added cybersecurity risks. Truist and Truist’s clients, regulators, vendors, service providers, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to and are likely to continue to be the target of cyberattacks and other similar incidents. Such incidents may expose security vulnerabilities in the Company’s systems, networks, or other security measures, or those of third parties, that could result in the unauthorized access, gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or other sensitive information, including personal information. Such incidents could also damage the Company’s systems and networks by introducing material disruptions to the Company’s or the Company’s clients’ or other third parties’ network access or business operations. As cybersecurity risks continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance the Company’s protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents. Despite efforts to ensure the integrity of the Company’s systems and networks and implement controls, processes, policies and other protective measures, the Company may not be able to anticipate all security breaches, nor may the Company be able to implement sufficient preventive measures against such security breaches, which may result in adverse consequences to Truist. 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. For example, cybersecurity risks may increase in the future as Truist continues to evolve its internal and external digital offerings and capabilities. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists and other external parties, including those involved in corporate espionage, any of which may see their effectiveness enhanced by the use of artificial intelligence, including the use of generative artificial intelligence to conduct more sophisticated social engineering attacks on the Company or clients. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred. In addition, the existence of cyberattacks or security breaches at third-party vendors and service providers with access to the Company’s data may not be disclosed to the Company in a timely manner. The Company also faces indirect technology, cybersecurity and other operational risks relating to clients and other third parties that the Company relies upon to facilitate or enable business activities, including, financial counterparties, regulators, vendors, service providers, and providers of critical infrastructure such as internet access and electrical power. While the Company performs cybersecurity due diligence on its key vendors and service providers, because the Company does not control its vendors or service providers and its ability to monitor their cybersecurity is limited, the Company cannot ensure the cybersecurity measures they take will be sufficient to protect any information the Company shares with them or prevent any disruption arising from a technology failure, cyberattack or other information or security breach. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems and networks, a technology failure, cyberattack or other information or security breach that significantly degrades, deletes, or compromises the systems, networks, or data of one or more financial entities could have an adverse impact on counterparties or other market participants. This consolidation, interconnectivity, and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack, other information or security breach, termination, or constraint could, among other things, adversely affect the Company’s ability to conduct transactions, service the Company’s clients, manage the Company’s exposure to risk or expand the Company’s business. A successful penetration or circumvention of system or network security could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining business relationships after a cyberattack or security breach; significant disruption to the Company’s operations and business; misappropriation, exposure or destruction of the Company’s confidential, proprietary, and other sensitive information, including personal information, and funds and those of the Company’s clients; damage to the Company’s or the Company’s clients’ or third parties’ computers, systems, or networks; or a violation of applicable laws and regulations, including those related to data privacy, data protection, and cybersecurity. This could result in litigation exposure, regulatory fines, penalties, loss of confidence in the Company’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, which could adversely impact the Company’s results of operations, liquidity, and financial condition. In addition, the Company may not have adequate insurance coverage, if any, to compensate for losses from any of the foregoing, and we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage as to any future claim. Cybersecurity and data-privacy risks have received heightened legislative, regulatory, and supervisory attention. Legislation and regulations on cybersecurity and data privacy, as well as related supervisory expectations, can compel us to enhance or modify our systems and infrastructure, invest in new systems and infrastructure, change our service providers, augment our scenario and vulnerability testing, and alter our business practices or our policies on security, data governance, and privacy. Any of these, in turn, can cause a significant increase in the complexity and costs of our operations and expose us to enforcement and other supervisory actions, related litigation by private plaintiffs, reputational damage, and a loss of client or investor confidence. Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 Truist Financial Corporation 27 The Company’s operating systems and infrastructure, as well as operational capabilities managed or supplied by third parties on whom we rely, could fail or be interrupted, compromised, or breached, which could disrupt the Company’s business and adversely impact the Company’s operations, financial condition, and prospects, as well as cause significant reputational damage and legal and financial exposure. The potential for operational risk exposure exists throughout the Company’s business and, as a result of the Company’s interactions with and reliance on third parties, is not limited to the Company’s own internal operational functions. The Company’s operational and security systems, networks, and infrastructure, including computer systems and networks, data management and internal processes, as well as those of third parties, are integral to the Company’s performance. Truist relies on numerous third-party vendors and service providers to conduct aspects of its business operations and faces operational risks relating to them. Third-party cybersecurity incidents, such as system breakdowns or failures, misconduct by the employees of such parties, or cyberattacks, including ransomware, and supply-chain compromises, could affect their ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its clients. Truist cannot be certain that it will receive timely notification of such cyberattacks or other security breaches or be able to exert any meaningful control or influence over how and when the breach is addressed. Like other large enterprises, Truist is subject to malicious cybersecurity risks and threats directed at its vendors, service providers, and other third parties. There is no guarantee that the measures the Company takes will provide absolute security or recoverability given that the techniques used in cyberattacks are complex and frequently change and are difficult to anticipate. Truist’s vendors, service providers, and other third parties may expose the Company to risk as a result of human error, misconduct, malfeasance, or a failure or breach of systems, networks, and infrastructure. For example, the Company’s ability to conduct business may be adversely affected by any significant disruptions to third parties with whom the Company interacts or relies upon. Truist is heavily reliant on technology, and a failure to effectively anticipate, develop, and implement new technology could harm us. The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services. Truist expects to make additional investments in innovation and technology to address technological disruption in the industry and improve client offerings and service. These changes are designed to allow the Company to better serve the Company’s clients and to reduce costs. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. Although we take steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or client impact and do not always perform as we or our clients expect. No assurance can be provided that initiatives in the future will be or will do so. The Company’s continued success depends, in part, upon the Company’s ability to address clients’ needs by using technology to provide products and services that satisfy client demands, including demands for faster and more secure payment services, to create efficiencies in the Company’s operations and to integrate those offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance the Company’s competitive position with respect to technology, whether because of a failure to anticipate client expectations, a failure in the performance of technological developments or an untimely roll out of developments, may cause the Company to lose market share or incur additional expense. Our use of systems and other technologies also depends on rights or interests in the underlying intellectual property, which we or our service providers may own or license. If we or a service provider were alleged or found to be infringing on the intellectual-property rights of another person or entity, we could be liable for significant damages for past infringement, substantial fees for continued use, and deprivation of access for limited or extended periods of time without the practical availability of an alternative. The Company faces risks associated with the quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes. The Company’s financial and regulatory reporting, public disclosures, and key business decisions are reliant on the quality, availability, and retention of data, including personal information. While Truist has a data risk management control framework to mitigate the risks associated with such data while at rest, in motion, and in use, this framework cannot guarantee that we will effectively mitigate risk and limit negative impacts on our business and operations. A control failure, for example, may lead to data breaches, data loss, data misuse, and data integrity and quality risks. These failures may ultimately result in inaccuracies in financial and regulatory reports, inhibited management decision-making, financial loss, reputational risk, and regulatory compliance risk, including data privacy, data protection, and cybersecurity compliance risks. We also can experience enforcement and other supervisory actions, damage to our reputation, and private litigation. 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation 28 Truist Financial Corporation

The Company faces cybersecurity risks, including denial of service, phishing, malware and ransomware attacks, potential insider threats, and third-party cybersecurity incidents, which could result in the disclosure of confidential information, adversely affect the Company’s operations, cause reputational damage, and create significant legal and financial exposure. The Company’s computer systems and network infrastructure and those of third parties are targeted in cyberattacks, such as denial of service attacks, hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities, or identity theft. The Company’s business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in the Company’s information systems and that of third parties. In addition, to access the Company’s network, products, and services, the Company’s clients and other third parties may use personal mobile devices or computing devices that are outside of the Company’s network environment and can introduce added cybersecurity risks. Truist and Truist’s clients, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to and are likely to continue to be the target of cyberattacks and similar incidents. Cyberattacks may expose security vulnerabilities in the Company’s systems or the systems of third parties or other security measures that could result in the unauthorized gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or sensitive information. A cyberattack could also damage the Company’s systems by introducing material disruptions to the Company’s or the Company’s clients’ or other third parties’ network access or business operations. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance the Company’s protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of the Company’s systems and implement controls, processes, policies and other protective measures, the Company may not be able to anticipate all security breaches, nor may the Company be able to implement sufficient preventive measures against such security breaches, which may result in material losses or consequences to Truist. Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. For example, cybersecurity risks may increase in the future as Truist continues to evolve its internal and external digital offerings and capabilities. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled teammates or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or well after a breach has occurred. In addition, the existence of cyberattacks or security breaches at third-party vendors with access to the Company’s data may not be disclosed to the Company in a timely manner. 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation The Company also faces indirect technology, cybersecurity and other operational risks relating to clients and other third parties that the Company relies upon to facilitate or enable business activities, including, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants. This consolidation, interconnectivity, and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack, other information or security breach, termination, or constraint could, among other things, adversely affect the Company’s ability to conduct transactions, service the Company’s clients, manage the Company’s exposure to risk or expand the Company’s business. A successful penetration or circumvention of system security could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining business relationships after an attack or breach; significant disruption to the Company’s operations and business; misappropriation, exposure or destruction of the Company’s confidential information, intellectual property, funds and those of the Company’s clients; damage to the Company’s or the Company’s clients’ or third parties’ computers or systems; or a violation of applicable privacy laws and other laws. This could result in litigation exposure, regulatory fines, penalties, loss of confidence in the Company’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, which could adversely impact the Company’s results of operations, liquidity, and financial condition. In addition, the Company may not have adequate insurance coverage to compensate for losses from a cybersecurity event. The Company’s operational capabilities managed or supplied by third parties could fail, be compromised, or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, and financial condition, as well as cause legal exposure or reputational harm. The potential for operational risk exposure exists throughout the Company’s business and, as a result of the Company’s interactions with and reliance on third parties, is not limited to the Company’s own internal operational functions. The Company’s operational and security systems and infrastructure, including computer systems, data management and internal processes, as well as those of third parties, are integral to the Company’s performance. Truist relies on numerous third-party service providers to conduct aspects of its business operations and faces operational risks relating to them. Third-party cybersecurity incidents, such as system breakdowns or failures, misconduct by the employees of such parties, or cyberattacks, including ransomware, and supply-chain compromises, could affect their ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its clients. Truist cannot be certain that we will receive timely notification of such cyberattacks or other security breaches. Like other large enterprises, Truist experiences malicious cyber activity directed at our vendors and other service providers. There is no guarantee that the measures the Company takes will provide absolute security or recoverability given that the techniques used in cyberattacks are complex and frequently change and are difficult to anticipate. Truist teammates and third parties may expose the Company to risk as a result of human error, misconduct, malfeasance, or a failure or breach of systems and infrastructure. For example, the Company’s ability to conduct business may be adversely affected by any significant disruptions, including to third parties with whom the Company interacts or relies upon. Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology. The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services. Truist expects to make additional investments in innovation and technology to address technological disruption in the industry and improve client offerings and service. These changes allow the Company to better serve the Company’s clients and to reduce costs. The Company’s continued success depends, in part, upon the Company’s ability to address clients’ needs by using technology to provide products and services that satisfy client demands, including demands for faster and more secure payment services, to create efficiencies in the Company’s operations and to integrate those offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance the Company’s competitive position with respect to technology, whether because of a failure to anticipate client expectations, a failure in the performance of technological developments or an untimely roll out of developments, may cause the Company to lose market share or incur additional expense. Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 The Company faces risks associated with quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes. The Company’s financial and regulatory reporting and key business decisions are reliant on the quality, availability, and retention of data. While Truist has implemented a robust data management control framework to mitigate the risks associated with data while at rest, in motion, and in use, a control failure may lead to data loss, data misuse, and data quality risks. These failures may ultimately result in inaccuracies in financial and regulatory reports, inhibited management decision-making, financial loss, reputational risk, and regulatory compliance risk, including privacy compliance risks to the extent that the Company has ineffective or flawed consumer data management processes and monitoring.

Physical, transition, and other risks associated with climate change, together with governmental responses to them, may negatively impact our business, operations, reputation, and clients. There is an increasing concern over the risks of climate change and related environmental sustainability matters. Climate change presents (i) physical risks from the direct impacts of changing climate patterns and acute weather events, such as damage to physical assets and service disruptions, and (ii) transition risks from changes in regulations, disruptive technologies, and shifting market dynamics towards a lower carbon economy. The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Physical risks may alter the Company’s strategic direction in order to mitigate certain financial risks. Such events could also disrupt the Company’s operations or those of its clients or third parties the Company relies on, not only through direct damage to assets, but also from indirect impacts due to supply chain disruption and market volatility. Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or client requirements, could have an adverse impact on asset values and the financial performance of Truist’s businesses, and those of its clients. Climate change could also present incremental risks to the execution of the Company’s long-term strategy. While material impact from climate change is expected to occur over a longer time horizon, the acceleration of a transition to a low-carbon economy could present idiosyncratic risks for individual companies. Additionally, transitioning to a low-carbon economy will entail extensive policy, legal, technology, and market initiatives. Governments are intensely focused on the effects of climate change and environmental issues, and how they act to mitigate related risks could have an adverse effect on our business and financial results. For example, the FRB has announced its development of a program of scenario analysis to evaluate the potential economic and financial risks posed by different climate outcomes, and this could have the effect of directly or indirectly compelling us to alter our businesses or operations in ways that would be detrimental to our results of operations and prospects. Such a program, moreover, could be followed by an incorporation of climate and related environmental risks into the FRB’s supervisory stress tests, which may negatively impact us and our future capital plans. Further, we may be compelled to change or cease some of our business or operational practices or to incur additional capital, compliance, and other costs because of climate- or environmental-driven changes in applicable law or supervisory expectations or due to related political, social, market, or similar pressure. Additionally, the Company faces potential reputational risks as a result of its practices related to climate change, including as a result of the Company’s direct or indirect involvement in certain industries, as well as any decisions management makes in response to managing climate risk, especially as views on climate-related matters become subject to increased polarization. Further, there is increased scrutiny of climate change-related policies, goals, and disclosures, which could result in litigation and regulatory investigations and actions. We may incur additional costs and require additional resources as we evolve our strategy, practices, and related disclosures with respect to these matters. As climate risk is interconnected with all key risk types, Truist continues to embed climate risk considerations into risk management strategies. Due to the level of uncertainty around the future path of climate change, the Company’s risk management strategies may not be effective in fully mitigating climate risk exposures. The Company is at risk of increased losses from fraud. Fraud attacks across the banking sector have significantly increased in recent years. Bad actors have industrialized the execution of fraud attacks with ever increasing sophistication and speed. Bad actors increasingly use sophisticated applications and techniques to perpetrate the fraud. In some cases, these individuals are associated with large criminal organizations that share tactics and strategies. Fraud schemes are wide ranging, including: counterfeit and forged checks; debit and credit card fraud; social engineering; ATM attacks through the use of skimmers to obtain client data; and phishing to obtain client account credentials. These schemes make use of a variety of products and services to steal funds, such as real-time payments, ACH, and wire transfers. Bad actors perpetuate fraudulent activity by impersonating real clients with stolen identities and account credentials, use other individuals, known as mules, to interact with Truist, or create new identities, referred to as synthetic identities. In some instances, the fraud is committed by existing clients. Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Truist Financial Corporation 29 Natural disasters, pandemics, and other catastrophic events could adversely impact us. The occurrence of natural disasters, extreme weather events, health crises, the occurrence or worsening of disease outbreaks or pandemics, such as COVID-19, or other catastrophic events, as well as government actions or other restrictions in connection with such events, could adversely affect the Company’s financial condition or results of operations. Truist has significant operations and clients along the Gulf and Atlantic coasts as well as other regions of the U.S., which could be adversely impacted by hurricanes, tornadoes and other severe weather in those areas. Truist and its clients could also be disrupted by the physical effects of climate change, which may become more frequent and severe. Natural and other types of disasters, including as a result of climate change, could have an adverse impact on Truist’s businesses in that such events could disrupt the Company’s operations or the ability or willingness of the Company’s clients to access the financial services offered by Truist, including adverse impacts on the Company’s borrowers to timely repay their loans and the value of any collateral held. These events could reduce the Company’s earnings and cause volatility in the Company’s financial results for any fiscal quarter or year and have an adverse effect on the Company’s financial condition and results of operations. Although Truist has business continuity plans and other safeguards in place, the Company’s operations and communications may be adversely affected by natural disasters or other catastrophic events, and there can be no assurance that such business continuity plans will be effective. An outbreak or escalation of hostilities between countries or within a country or region could have an adverse effect on the U.S. economy and on Truist’s business operations and key external parties. Aggressive actions by hostile governments or groups, including armed conflict or intensified cyberattacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains, and diminished consumer, business and investor confidence. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, Truist’s operations and earnings. Truist, its service providers, and participants in the financial system could also experience increasing levels and more aggressive cyberattacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

The effects of COVID-19 adversely impacted the Company’s operations and financial performance and similar adverse impacts resulting from pandemics could occur in future periods. Although the global economy has begun to recover from the COVID-19 pandemic, as many health and safety restrictions have been lifted and vaccine distribution has increased, certain adverse consequences of the pandemic, including labor shortages, disruptions of global supply chains and inflationary pressures, continue to impact the macroeconomic environment and could adversely affect our business. In addition, a significant portion of the Company’s workforce continues to work remotely at least on a part-time basis, which may increase cybersecurity risks to the Company. Commercial clients have experienced varying levels of disruptions on their supply chains or decreases in demand for their products and services. Consumer clients have experienced interrupted income or unemployment. Certain industries have been particularly susceptible to the effects of the pandemic, including industries where Truist has outstanding loans to clients. The effects of the pandemic initially resulted in an increase in the allowance for credit losses, a reduction of fee income, a reduction of net interest margin, a decrease in demand for certain types of loans, and an increase in expenses. A resurgence of pandemic conditions could reintroduce these impacts and also affect the Company’s capital and liquidity position, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause an outflow of deposits, influence the recognition of credit losses on loans and securities and increase the allowance for credit losses, result in additional lost revenue, cause additional increases in expenses, result in goodwill impairment charges, result in the impairment of other financial and nonfinancial assets, and increase the Company’s cost of capital. Physical, transition, or other risks associated with climate change have the potential to negatively impact operations, business results, and clients. There is an increasing concern over the risks of climate change and related environmental sustainability matters. Climate change presents (i) physical risks from the direct impacts of changing climate patterns and acute weather events, such as damage to physical assets and service disruptions, and (ii) transition risks from changes in regulations, disruptive technologies, and shifting market dynamics towards a lower carbon economy. The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Physical risks may alter the Company’s strategic direction in order to mitigate certain financial risks. Such events could also disrupt the Company’s operations or those of its clients or third parties the Company relies on, not only through direct damage to assets, but also from indirect impacts due to supply chain disruption and market volatility. Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or client requirements, could have a material adverse impact on asset values and the financial performance of Truist’s businesses, and those of its clients. Climate change could also present incremental risks to the execution of the Company’s long-term strategy. While material impact from climate change is expected to occur over a longer time horizon, the acceleration of a transition to a low-carbon economy could present idiosyncratic risks for individual companies. Additionally, transitioning to a low-carbon economy will entail extensive policy, legal, technology, and market initiatives. Additionally, the Company faces potential reputational risks as a result of its practices related to climate change, including as a result of the Company’s direct or indirect involvement in certain industries, as well as any decisions management makes in response to managing climate risk, especially as views on climate-related matters become subject to increased polarization. As climate risk is interconnected with all key risk types, Truist continues to embed climate risk considerations into risk management strategies. Due to the level of uncertainty around the future path of climate change, the Company’s risk management strategies may not be effective in fully mitigating climate risk exposures. 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation 26 Truist Financial Corporation The Company is at risk of increased losses from fraud. Fraud attacks across the banking sector have significantly increased in recent years. Bad actors have industrialized the execution of fraud attacks with ever increasing sophistication and speed. Bad actors increasingly use sophisticated applications and techniques to perpetrate the fraud. In some cases, these individuals are associated with large criminal organizations that share tactics and strategies. Fraud schemes are wide ranging, including: counterfeit and forged checks; debit and credit card fraud; social engineering; ATM attacks through the use of skimmers to obtain client data; and phishing to obtain client account credentials. These schemes make use of a variety of products and services to steal funds, such as real-time payments, ACH and wire transfers. Bad actors perpetuate fraudulent activity by impersonating real clients with stolen identities and account credentials, use other individuals, known as mules, to interact with Truist, or create new identities, referred to as synthetic identities. In some instances, the fraud is committed by existing clients. Natural disasters and other catastrophic events, which may increase in frequency and intensity due to climate change, could have a material adverse impact on the Company’s operations or the Company’s financial condition and results. The occurrence of catastrophic weather events or pandemics could adversely affect the Company’s financial condition or results of operations. Truist has significant operations and clients along the Gulf and Atlantic coasts as well as other regions of the U.S., which could be adversely impacted by hurricanes, tornadoes and other severe weather in those areas. Truist and its clients could also be disrupted by the physical effects of climate change, which may become more frequent and severe. Natural and other types of disasters, including as a result of climate change, could have an adverse impact on Truist’s businesses in that such events could materially disrupt the Company’s operations or the ability or willingness of the Company’s clients to access the financial services offered by Truist, including adverse impacts on the Company’s borrowers to timely repay their loans and the value of any collateral held. These events could reduce the Company’s earnings and cause volatility in the Company’s financial results for any fiscal quarter or year and have a material adverse effect on the Company’s financial condition and results of operations. Although Truist has business continuity plans and other safeguards in place, the Company’s operations and communications may be adversely affected by natural disasters or other catastrophic events, and there can be no assurance that such business continuity plans will be effective. An outbreak or escalation of hostilities between countries or within a country or region could have a material adverse effect on the U.S. economy and on Truist’s businesses. Aggressive actions by hostile governments or groups, including armed conflict or intensified cyberattacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains, and diminished consumer, business and investor confidence. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, Truist’s operations and earnings. Truist could also experience more numerous and aggressive cyberattacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

Truist relies extensively on other companies to provide key components of the Company’s business infrastructure, and their failure to perform to our standards or other issues of concern with them could harm us. Third parties provide key components of the Company’s business infrastructure, such as banking services, data processing, business processes, internet connections, and network access. While we have implemented a supplier risk management program and can exert varying degrees of influence over our service providers, we do not control them, their actions, or their businesses. Our contracts with service providers, moreover, may not require or sufficiently incent them to perform at levels and in ways that we would choose to act on our own. Despite our supplier-risk-management program, service providers have not always met our requirements and expectations, and no assurance can be provided that in the future they will perform to our standards, adequately represent our brand, comply with applicable law, appropriately manage their own risks, including cybersecurity, remain financially or operationally viable, abide by their contractual obligations, or continue to provide us with the services that we require. Disruption in services provided by these third parties or any failure of these third parties to handle current or higher volumes of use could adversely affect the Company’s ability to deliver products and services to clients, to support teammates and otherwise to conduct business. Technological or financial difficulties of a third-party service provider could adversely affect the Company’s business to the extent those difficulties result in the interruption or discontinuation of services provided by that party. Further, in some instances, the Company may be responsible for failures of such third parties to comply with government regulations. We may need to incur substantial expenses to address issues with a service provider, and if the issues cannot be acceptably resolved, we may not be able to timely or effectively replace the service provider due to contractual restrictions, the unavailability of acceptable alternative providers, or other reasons. Further, regardless of how much we can influence our service providers, issues of concern with them could result in supervisory actions and private litigation against us and could harm our reputation, business, and financial results. The Company is not insured against all types of losses as a result of third-party failures, and the insurance coverage that does exist may be inadequate to protect the Company from all losses resulting from system failures or other disruptions. Failures in the Company’s business infrastructure could interrupt its operations or increase the costs of doing business. The Company’s framework for managing risks and mitigating losses may not be effective. The Company’s risk management framework seeks to mitigate risk and loss. Truist has established policies, processes, and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which the Company is subject, including liquidity, credit, market, operational, technology, reputational, strategic, and compliance risk, among others. We continuously improve the risk-management framework in response to internal reviews and assessments, evolving industry practices, and changes in business and regulatory expectations. Even with these improvements, however, the framework cannot guarantee that we will effectively mitigate risk and limit losses in our business and operations. For example, the Company’s risk management measures may not be fully effective in identifying and mitigating the Company’s risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the frameworks for assessing risk are properly designed and implemented. Some of the Company’s methods of managing risk are based upon the Company’s use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If the Company’s risk management framework proves ineffective, it could suffer unexpected losses and could be adversely affected. In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist depends on the accuracy and completeness of information about clients and counterparties. In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist relies on the completeness and accuracy of representations made by and information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. If the information provided is not accurate or complete, the Company’s decisions about extending credit or entering into other transactions with clients or counterparties could be adversely affected, and the Company could suffer defaults, credit losses or other negative consequences as a result. 40 Truist Financial Corporation 40 Truist Financial Corporation 40 Truist Financial Corporation 40 Truist Financial Corporation 40 Truist Financial Corporation 40 Truist Financial Corporation Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms. When Truist launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business or makes changes to an existing product, service or delivery platform, it may not fully appreciate or identify new operational risks that may arise from those changes, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish Truist’s ability to operate one or more of its businesses or result in potential liability to clients and counterparties, and result in increased operating expenses. The Company could also experience higher litigation costs, including regulatory fines, penalties and other sanctions, reputational damage, impairment of Truist’s liquidity, regulatory intervention, or weaker competitive standing. Any of the foregoing consequences could and adversely affect Truist’s businesses and results of operations. Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures. The Company must comply with enhanced regulatory and other standards associated with doing business with vendors and other service providers, including standards relating to the outsourcing of functions as well as the performance of significant banking and other functions by subsidiaries. Truist incurs significant costs and expenses in connection with its initiatives to address the risks associated with oversight of its internal and external service providers. Truist’s failure to appropriately assess and manage these relationships, especially those involving significant banking functions, shared services or other critical activities, could adversely affect Truist. Specifically, any such failure could result in: potential harm to clients, and any liability associated with that harm; regulatory fines, penalties or other sanctions; lower revenues, and the opportunity cost from lost revenues; increased operational costs, or harm to Truist’s reputation. ITEM 1C. CYBERSECURITY Refer to the Risk Management section of MD&A for a discussion of cybersecurity risk, which is incorporated by reference into this item.

Truist relies on other companies to provide key components of the Company’s business infrastructure. Third parties provide key components of the Company’s business infrastructure, such as banking services, data processing, business processes, internet connections, and network access. Any disruption in such services provided by these third parties or any failure of these third parties to handle current or higher volumes of use could adversely affect the Company’s ability to deliver products and services to clients, to support teammates and otherwise to conduct business. Technological or financial difficulties of a third-party service provider could adversely affect the Company’s business to the extent those difficulties result in the interruption or discontinuation of services provided by that party. Further, in some instances, the Company may be responsible for failures of such third parties to comply with government regulations. The Company is not insured against all types of losses as a result of third-party failures, and the insurance coverage that does exist may be inadequate to protect the Company from all losses resulting from system failures or other disruptions. Failures in the Company’s business infrastructure could interrupt its operations or increase the costs of doing business. The Company’s framework for managing risks may not be effective. The Company’s risk management framework seeks to mitigate risk and loss. Truist has established policies, processes, and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which the Company is subject, including liquidity, credit, market, operational, technology, reputational, strategic, and compliance risk, among others. However, the Company’s risk management measures may not be fully effective in identifying and mitigating the Company’s risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the frameworks for assessing risk are properly designed and implemented. Some of the Company’s methods of managing risk are based upon the Company’s use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If the Company’s risk management framework proves ineffective, it could suffer unexpected losses and could be materially adversely affected. Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist depends on the accuracy and completeness of information about clients and counterparties. In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist relies on the completeness and accuracy of representations made by and information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. If the information provided is not accurate or complete, the Company’s decisions about extending credit or entering into other transactions with clients or counterparties could be adversely affected and the Company could suffer defaults, credit losses or other negative consequences as a result. Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms. When Truist launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business or makes changes to an existing product, service or delivery platform, it may not fully appreciate or identify new operational risks that may arise from those changes, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish Truist’s ability to operate one or more of its businesses or result in potential liability to clients and counterparties, and result in increased operating expenses. The Company could also experience higher litigation costs, including regulatory fines, penalties and other sanctions, reputational damage, impairment of Truist’s liquidity, regulatory intervention, or weaker competitive standing. Any of the foregoing consequences could materially and adversely affect Truist’s businesses and results of operations. Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures. The Company must comply with enhanced regulatory and other standards associated with doing business with vendors and other service providers, including standards relating to the outsourcing of functions as well as the performance of significant banking and other functions by subsidiaries. Truist incurs significant costs and expenses in connection with its initiatives to address the risks associated with oversight of its internal and external service providers. Truist’s failure to appropriately assess and manage these relationships, especially those involving significant banking functions, shared services or other critical activities, could materially adversely affect Truist. Specifically, any such failure could result in: potential harm to clients, and any liability associated with that harm; regulatory fines, penalties or other sanctions; lower revenues, and the opportunity cost from lost revenues; increased operational costs, or harm to Truist’s reputation.

Our inability to retain and grow deposits or a change in deposit costs or mix could negatively impact our funding strategy and financial results. Deposits are a relatively low cost and stable source of funding. Truist competes with banks and other financial institutions for deposits and as a result, the Company could lose deposits in the future, clients may shift their deposits into higher cost products, or the Company may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits lost are replaced with wholesale funding. Higher funding costs reduce Truist’s net interest margin, net interest income, and net income. In the current environment, maintaining and growing deposits has become more challenging as the FRB reduced the size of its balance sheet through quantitative tightening and increased interest rates giving clients an incentive to move deposits to money market funds and other higher-yielding alternatives. In addition, our ability to maintain, grow, or favorably price deposits may be constrained by gaps in our product and service offerings, changes in consumer trends, our scale relative to other financial institutions, competition from fintech companies and emerging financial-services providers, any failures or deterioration in our client service, or any loss of confidence in our brand or our business. 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation 24 Truist Financial Corporation Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or an inability to monetize liquid assets. Liquidity is the ability to fund increases in assets and meet obligations as they come due, all without incurring unacceptable losses. Banks are especially vulnerable to liquidity risk because of their role in the maturity transformation of demand or short-term deposits into longer-term loans or other extensions of credit. We, like other financial-services companies, rely to a significant extent on external sources of funding, such as deposits and borrowings, for the liquidity needed to conduct our business and operations. A number of factors beyond our control, however, could have a detrimental impact on the availability or cost of that funding and thus on our liquidity. When volatility or disruptions occur in the wholesale funding markets, the Company’s ability to access short-term liquidity could be impaired. In addition, idiosyncratic factors, including realization of other risks described herein, as well as other factors outside of the Company’s control, such as a general market disruption or an operational problem that affects third parties, could impair the Company’s ability to access short-term or contingent funding, sources or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or deposit attrition. The Company’s inability to monetize liquid assets without unacceptable losses or to access short-term funding or capital markets could constrain the Company’s ability to make new loans or meet existing lending commitments and could ultimately jeopardize the Company’s overall liquidity and capitalization. While our policies and controls are designed to enable us to maintain adequate liquidity to conduct our business in the ordinary course even in a stressed environment, there is no guarantee that our liquidity position will never become compromised. Such an event could damage the performance and value of our business, prompt regulatory intervention and private litigation, harm our reputation, and cause a loss of client and investor confidence, and if the condition were to persist for any appreciable period of time, our viability as a going concern could be threatened. A disruption in our access to the mortgage secondary market and GSEs for liquidity could negatively affect us. Truist sells a portion of the mortgage loans that it originates to reduce the Company’s retained credit risk and to provide funding capacity for originating additional loans. GSEs could limit their purchases of conforming loans due to capital constraints or other changes in their criteria for conforming loans (e.g., maximum loan amount or borrower eligibility). This potential reduction in purchases could limit the Company’s ability to fund new loans. Proposals have been presented to reform the housing finance market in the U.S., including the role of the GSEs in the housing finance market. The extent and timing of any such regulatory reform of the housing finance market and the GSEs, as well as any effect on the Company’s business and financial results, are uncertain. The Company’s cost of funding or access to the banking and capital markets could be adversely affected if our credit ratings are downgraded or otherwise fail to meet investor expectations. Credit ratings are influenced by many factors, including the Company’s profitability, asset quality, capital levels, liquidity, business mix, operations, and risk management practices. Credit ratings may also be influenced by other factors, some of which are outside the Company’s control, such as recent and anticipated economic trends, geopolitical risk, legislative and regulatory developments, including implied levels of government support during a crisis, environmental, social, and governance considerations, and litigation, as well as changes to the rating agencies’ methodologies, among others. Truist’s failure to maintain credit ratings could adversely affect funding costs and increase the Company’s cost of capital. A downgrade to Truist’s credit ratings might also adversely impact the Company’s ability to conduct derivatives business with certain clients and counterparties and could trigger obligations to make cash or collateral payments to certain clients and counterparties. Additionally, a ratings downgrade could affect the Company’s ability to attract or retain funding, including deposits from commercial and corporate clients. The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends. The Parent Company relies upon capital markets access and dividends from affiliates for funding and has less access to contingent funding sources than the Bank. If the Bank were subject to a financial stress, its dividends to the Parent Company could be reduced or eliminated in order to support Bank capital ratios or other regulatory requirements. This would increase the Parent Company’s reliance on capital markets at a time when spreads and funding costs are likely elevated due to the stress impacting the Bank and would also impair the Parent Company’s ability to serve as a source of strength to its subsidiaries. Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 Truist Financial Corporation 25 The financial system is highly interrelated, and financial or systemic shocks or the failure of even a single financial institution or other participant in the financial system could adversely impact us. Adverse developments affecting the overall strength and soundness of other financial institutions, the financial services industry as a whole and the general economic climate and the U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships could also negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face. Truist may be impacted by actual or perceived soundness of other financial institutions, including as a result of the financial or operational failure of a major financial institution, or concerns about the creditworthiness of such a financial institution or its ability to fulfill its obligations, which can cause substantial and cascading disruption within the financial markets and increased expenses, including FDIC insurance premiums, and could affect our ability to attract and retain depositors and to borrow or raise capital. For example, during 2023 the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank. The failure of other banks and financial institutions and the measures taken by governments, businesses, and other organizations in response to these events could adversely impact the Company’s business, financial condition and results of operations. The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. Truist has exposure to many different industries and counterparties and routinely executes transactions with counterparties in the financial industry, including brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds and other institutional investors and clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions or the financial services industry generally, in the past have led to market-wide liquidity problems and could lead to losses or defaults by Truist or by other institutions. Many of these transactions expose the Company to credit risk in the event of default of the Company’s counterparty or client. In addition, the Company’s credit risk may be exacerbated when the collateral held by Truist cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the Company’s exposure. Any such losses could adversely affect the Company’s results of operations and financial condition.

Loss of deposits or a change in deposit mix could increase Truist’s funding costs. Deposits are a low cost and stable source of funding. Truist competes with banks and other financial institutions for deposits and as a result, the Company could lose deposits in the future, clients may shift their deposits into higher cost products, or the Company may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits lost are replaced with wholesale funding. Higher funding costs reduce Truist’s net interest margin, net interest income, and net income. In recent months, the environment for maintaining and growing deposits has become more challenging as the FRB reduces the size of its balance sheet through quantitative tightening and continues to increase interest rates giving clients an incentive to move deposits to money market funds and other higher-yielding alternatives, which could lead to an increase in the reliance on higher cost wholesale funding. Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets. Liquidity is essential to Truist’s businesses. When volatility or disruptions occur in the wholesale funding markets, the Company’s ability to access short-term liquidity could be materially impaired. In addition, idiosyncratic factors, as well as other factors outside of the Company’s control, such as a general market disruption or an operational problem that affects third parties, could impair the Company’s ability to access short-term funding or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or deposit attrition. The Company’s inability to monetize liquid assets or to access short-term funding or capital markets could constrain the Company’s ability to make new loans or meet existing lending commitments and could ultimately jeopardize the Company’s overall liquidity and capitalization. Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity. Truist sells a portion of the mortgage loans that it originates to reduce the Company’s retained credit risk and to provide funding capacity for originating additional loans. GSEs could limit their purchases of conforming loans due to capital constraints or other changes in their criteria for conforming loans (e.g., maximum loan amount or borrower eligibility). This potential reduction in purchases could limit the Company’s ability to fund new loans. Proposals have been presented to reform the housing finance market in the U.S., including the role of the GSEs in the housing finance market. The extent and timing of any such regulatory reform of the housing finance market and the GSEs, as well as any effect on the Company’s business and financial results, are uncertain. Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets. Credit ratings are influenced by many factors, including the Company’s profitability, asset quality, capital levels, liquidity, business mix, operations, and risk management practices. Credit ratings may also be influenced by other factors, some of which are outside the Company’s control, such as recent and anticipated economic trends, geopolitical risk, legislative and regulatory developments, including implied levels of government support during a crisis, environmental, social, and governance considerations, and litigation, as well as changes to the rating agencies’ methodologies, among others. Truist’s failure to maintain credit ratings could adversely affect funding costs and increase the Company’s cost of capital. A downgrade to Truist’s credit ratings might also adversely impact the Company’s ability to conduct derivatives business with certain clients and counterparties and could trigger obligations to make cash or collateral payments to certain clients and counterparties. Additionally, a ratings downgrade could affect the Company’s ability to attract or retain funding, including deposits from commercial and corporate clients. Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress. The Parent Company relies upon capital markets access and dividends from affiliates for funding and has less access to contingent funding sources than the Bank. If the Bank were subject to a financial stress, its dividends to the Parent Company could be reduced or eliminated in order to support Bank capital ratios or other regulatory requirements. This would increase the Parent Company’s reliance on capital markets at a time when spreads and funding costs are likely elevated due the stress impacting the Bank. Truist may be impacted by the soundness of other financial institutions. The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. Truist has exposure to many different industries and counterparties and routinely executes transactions with counterparties in the financial industry, including brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds and other institutional investors and clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions or the financial services industry generally, in the past have led to market-wide liquidity problems and could lead to losses or defaults by Truist or by other institutions. Many of these transactions expose the Company to credit risk in the event of default of the Company’s counterparty or client. In addition, the Company’s credit risk may be exacerbated when the collateral held by Truist cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the Company’s exposure. Any such losses could materially and adversely affect the Company’s results of operations and financial condition.

Negative public opinion, whether real or perceived, or our failure to successfully manage it could damage the Company’s reputation and adversely impact our business, financial condition, results of operations, and prospects. Truist’s earnings, capital, and stock price are subject to risks associated with negative public opinion. Negative public opinion could result from the Company’s actual or alleged conduct in any number of activities, including lending, sales and other operating practices, corporate governance, acquisitions, a breach of client or teammate information, the failure of any product or service sold to meet clients’ expectations or applicable regulatory requirements. In addition, the public perception that a cyberattack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with clients and third parties with whom the Company does business. The compromise of personal information, in particular, could result in identity theft and cause serious reputational harm. Any cybersecurity breaches, attacks and other similar incidents could significantly harm Truist’s reputation, which could adversely affect the Company’s financial condition and results of operation. Negative public opinion could also result from increased polarization of environmental and social considerations that may affect Truist and clients of Truist. The proliferation of social media may increase the likelihood that negative public opinion from any of the real or perceived events discussed above could impact our reputation and business. Negative public opinion could adversely affect the Company’s ability to attract and retain clients and teammates and can result in litigation and regulatory actions. Actual or alleged conduct by one of the Company’s businesses can result in negative public opinion about the Company’s other businesses. Actual or alleged conduct by another financial services company can result in negative public opinion about the financial services industry in general and, as a result, adversely affect Truist. Our efforts to identify, measure and monitor reputational risk and communicate, internally and externally, such risks to key stakeholders, may be ineffective, untimely, or otherwise result in adverse effects on the Company. Truist Financial Corporation 37 Truist Financial Corporation 37 Truist Financial Corporation 37 Truist Financial Corporation 37 Truist Financial Corporation 37 Truist Financial Corporation 37 Truist may face reputational risks arising out of Truist’s sales, training, incentive compensation or business practices, products or services, or other activities of its teammates, representatives, or business partners. The Company may face increased scrutiny of its sales and other business practices, training practices, incentive compensation design and governance, and quality assurance and client complaint resolution practices. There can be no assurance that the Company’s processes and actions will meet regulatory standards or expectations. Findings from self-identified or regulatory reviews may require responsive actions, including increased investments in compliance systems and teammates or the payment of fines, penalties, increased regulatory assessments or client redress and may increase legal or reputational risk exposures.

Negative public opinion could damage the Company’s reputation and adversely impact business and revenues. Truist’s earnings and capital are subject to risks associated with negative public opinion. Negative public opinion could result from the Company’s actual or alleged conduct in any number of activities, including lending, sales and other operating practices, corporate governance, acquisitions, a breach of client or teammate information, the failure of any product or service sold to meet clients’ expectations or applicable regulatory requirements. In addition, the public perception that a cyber-attack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with clients and third parties with whom the Company does business. The compromise of personal information, in particular, could result in identify theft and cause serious reputational harm. Any cybersecurity breaches, attacks and other similar incidents could significantly harm Truist’s reputation, which could adversely affect the Company’s financial condition and results of operation. Negative public opinion could also result from increased polarization of environmental and social considerations that may affect Truist and clients of Truist. Negative public opinion could adversely affect the Company’s ability to attract and retain clients and teammates and can result in litigation and regulatory actions. Actual or alleged conduct by one of the Company’s businesses can result in negative public opinion about the Company’s other businesses. Actual or alleged conduct by another financial services company can result in negative public opinion about the financial services industry in general and, as a result, adversely affect Truist. Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues. The Company may face increased scrutiny of its sales and other business practices, training practices, incentive compensation design and governance, and quality assurance and client complaint resolution practices. There can be no assurance that the Company’s processes and actions will meet regulatory standards or expectations. Findings from self-identified or regulatory reviews may require responsive actions, including increased investments in compliance systems and teammates or the payment of fines, penalties, increased regulatory assessments or client redress and may increase legal or reputational risk exposures.

The Company is subject to credit risk by lending, committing to lend money, and entering into letters of credit and other types of contracts with counterparties and the Company’s allowance for loan losses may not be adequate to cover actual losses. Truist incurs credit risk, which is the risk to current or anticipated earnings or capital arising from the default, unwillingness or inability of a borrower, obligor, or counterparty such that an obligation will not be repaid on time or in full, or otherwise according to the terms of the contract. A number of products expose the Company to credit risk, including loans and leases, lending commitments, derivatives, trading assets, and investment securities. Changes in credit quality can have a significant impact on the Company’s earnings and capital position. The Company estimates and establishes contractual lifetime reserves for credit risks and credit losses inherent in its determination of credit exposure. This process, which is critical to the Company’s financial results and condition, requires complex calculations and extensive use of judgment, considering both external and borrower-specific factors that might impair the ability of borrowers to repay their loans. As is the case with any such assessments, there is always the chance that the Company will fail to identify all pertinent factors or that the Company will fail to accurately estimate the impacts of factors identified and that its allowance for loan losses may not be adequate to cover actual losses. Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Truist Financial Corporation 23 Credit losses may exceed the amount of the Company’s reserves due to changing economic conditions, falling real estate prices, falling commodity prices, higher unemployment, or other factors such as changes in borrower behavior. There is no assurance that reserves will be sufficient to cover all credit losses. In the event of significant deterioration in current or projected future economic conditions, the Company may be required to increase reserves in future periods, which would reduce the Company’s earnings and potentially impact its capital. The Company may have more credit risk and higher credit losses if our underwriting standards and practices are inadequate, we adopt more liberal underwriting standards for competitive or other reasons, or our concentration and other risk limits are not well calibrated. The Company’s credit risk and credit losses can increase if the Company’s loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by economic conditions, market conditions, or climate change. Increased delinquencies or defaults could also result from our failing to appropriately underwrite loans and other products that we originate or purchase or from our adopting—for strategic, competitive, or other reasons—more liberal underwriting standards. There can be no assurance that our forecasts of economic conditions, our assessments and monitoring of credit risk, and our efforts to mitigate credit risk through risk-based pricing, appropriate underwriting and investment policies, loss-mitigation strategies, and diversification are or will be sufficient to prevent an adverse impact to our business and financial results. Deterioration in economic conditions, housing conditions, or real estate values, including as a result of climate change or natural disasters, in the markets in which the Company operates could result in higher credit losses. The Company is also subject to physical risks of climate change, which could manifest in the form of asset quality deterioration and could be exacerbated by specific portfolio concentrations, and transition risks of climate change, which could manifest through longer-term shifts in market dynamics and consumer preferences, and could be exacerbated in specific industries that may be more sensitive or vulnerable to a transition to a low carbon economy. The Company may suffer losses if the value of collateral declines in weak, deteriorating, or stressed economic or market conditions. During periods of market stress or illiquidity, the Company’s credit risk may be further increased if it fails to realize the expected value of the collateral it holds; collateral is liquidated at prices that are not sufficient to recover the full amount owed to Truist; or counterparties are unable to post collateral, whether for operational or other reasons. Furthermore, disputes with counterparties concerning the valuation of collateral may increase in times of significant market stress, volatility or illiquidity, and Truist could suffer losses during these periods if it is unable to realize the expected value of collateral or to manage declines in the value of collateral.

The Company is subject to credit risk by lending, committing to lend money, or entering into a letter of credit or other types of contracts with counterparties. Truist incurs credit risk, which is the risk of loss if the Company’s borrowers or counterparties fail to perform according to the terms of their contracts. A number of products expose the Company to credit risk, including loans and leases, lending commitments, derivatives, trading assets, and investment securities. Changes in credit quality can have a significant impact on the Company’s earnings and capital position. The Company estimates and establishes contractual lifetime reserves for credit risks and credit losses inherent in its determination of credit exposure. This process, which is critical to the Company’s financial results and condition, requires complex calculations and extensive use of judgment, considering both external and borrower-specific factors that might impair the ability of borrowers to repay their loans. As is the case with any such assessments, there is always the chance that the Company will fail to identify all pertinent factors or that the Company will fail to accurately estimate the impacts of factors identified. Credit losses may exceed the amount of the Company’s reserves due to changing economic conditions, falling real estate prices, falling commodity prices, higher unemployment, or other factors such as changes in borrower behavior. There is no assurance that reserves will be sufficient to cover all credit losses. In the event of significant deterioration in current or projected future economic conditions, the Company may be required to increase reserves in future periods, which would reduce the Company’s earnings and potentially impact its capital. The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral. The Company’s credit risk and credit losses can increase if the Company’s loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by economic, market conditions, or climate change. Deterioration in economic conditions, housing conditions, or real estate values, including as a result of climate change or natural disasters, in the markets in which the Company operates could result in materially higher credit losses. The Company is also subject to physical risks of climate change, which could manifest in the form of asset quality deterioration and could be exacerbated by specific portfolio concentrations, and transition risks of climate change, which could manifest through longer-term shifts in market dynamics and consumer preferences and could be exacerbated in specific industries that may be more sensitive or vulnerable to a transition to a low carbon economy. 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation The Company may suffer losses if the value of collateral declines in stressed market conditions. During periods of market stress or illiquidity, the Company’s credit risk may be further increased when it fails to realize the expected value of the collateral it holds; collateral is liquidated at prices that are not sufficient to recover the full amount owed to Truist; or counterparties are unable to post collateral, whether for operational or other reasons. Furthermore, disputes with counterparties concerning the valuation of collateral may increase in times of significant market stress, volatility or illiquidity, and Truist could suffer losses during these periods if it is unable to realize the expected value of collateral or to manage declines in the value of collateral.

Ineffective execution of strategic initiatives could adversely affect investor sentiment and our business and financial results. There is no guarantee that our strategic initiatives, including our current initiatives to streamline and simplify our business, reduce expenses, as well as, to increase digitization, will ultimately be successful. Our execution of strategic initiatives may be impacted by internal factors, such as maintaining a level of earnings appropriate to support growth objectives, the ability to maintain dividends in various economic cycles, or the successful delivery of innovative and technology strategies. In addition, our execution of our strategies may be impacted by our response to external factors, including geopolitical, macroeconomic, social, cultural, competitive, and regulatory factors. To the extent we are impeded or unable to execute effective strategic initiatives, our prospects for growth, earnings, capital levels, and stock price as well as stakeholder confidence in Truist could be adversely affected. Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Truist Financial Corporation 35 Competition may reduce Truist’s client base or cause Truist to modify the pricing or other terms for products and services, which could have an adverse impact on our business and financial results. Truist operates in a highly competitive industry that could become even more competitive with growth in areas such as neo-banks, fintechs, and other non-bank platforms. Increased competition could arise from technological advancements, legislative and regulatory changes, as well as competition from other financial services companies, some of which may be subject to less extensive regulation than Truist. The Company’s success depends, in part, on the Company’s ability to adapt its offering of products and services to evolving industry standards and client expectations. The widespread adoption of new technologies has required and will continue to require substantial investments to modify existing products and services or to develop new products and services. In addition, there is increasing pressure to provide products and services at lower prices further reducing contribution margins. The Company may not be successful in introducing new products and services in response to industry trends or developments in technology or those new products may not achieve market acceptance. Truist also competes with nonbank companies inside and outside of the Company’s market area and, in some cases, with companies other than those traditionally considered financial sector participants. In particular, technology companies are increasingly focusing on the financial sector, either in partnership with competitor banking organizations or on their own. These companies generally are not subject to the same regulatory oversight as main street financial institutions and may accordingly realize certain cost strategies and offer products and services at more favorable rates and with greater convenience to the client. This competition could result in the loss of clients and revenue in areas where fintechs are operating. As the pace of technology and change advance, continuous innovation is expected to exert long-term pressure on the financial services industry. The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality, artificial intelligence, and cryptocurrencies, could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure. Acquisitions, mergers, and divestitures introduce a broad range of anticipated and unanticipated risks, including unforeseen or negative consequences from supervisory or regulatory action that may limit Truist’s ability to pursue and complete them. We may from time to time seek to acquire other financial-services companies or businesses. Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower than expected performance, higher than expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with clients or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing shareholders if we were to issue common stock to fully or partially pay or fund the purchase price. We, moreover, may not be successful in identifying appropriate acquisition candidates, integrating acquired companies or businesses, or realizing expected value from acquisitions. There is significant competition for valuable acquisition targets, and we may not be able to acquire other companies or businesses on attractive terms. No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions. The Company must satisfy a number of meaningful conditions before completing an acquisition of another bank or BHC, including federal and state regulatory approvals. In determining whether to approve a proposed bank or BHC acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition; financial condition and future prospects, including current and projected capital ratios and levels; the competence, experience and integrity of management; the supervisory relationship; record of compliance with laws and regulations; the convenience and needs of the communities to be served, including the acquiring institution’s record of compliance under the CRA; the effectiveness of the acquiring institution in combating money laundering activities; and public comments from various stakeholders. In addition, U.S. regulators must take systemic risk to the U.S. financial system into account when evaluating whether to approve a potential acquisition transaction involving a large financial institution like Truist. There is no certainty as to when or if or on what terms and conditions, any required regulatory approvals will be granted for any potential acquisition. In specific cases, Truist may be required to sell banks or branches or take other actions as a condition to receiving regulatory approval. An inability to satisfy other conditions necessary to consummate an acquisition transaction, such as third-party litigation, a judicial order blocking the transaction or lack of shareholder approval, could also prevent the Company from completing an announced acquisition. There has been increased scrutiny of bank and financial institution acquisitions from regulators and government entities in recent years. Refer to the “Acquisitions” section within Item 1 “Business” for additional discussion. 36 Truist Financial Corporation 36 Truist Financial Corporation 36 Truist Financial Corporation 36 Truist Financial Corporation 36 Truist Financial Corporation 36 Truist Financial Corporation In addition, we may decide to divest certain businesses or assets. For example, we entered into an equity interest purchase agreement for the sale of our remaining equity interests in TIH on February 20, 2024. Purchases or divestitures of businesses involve a number of risks, including significant costs and expenses, and any divestiture we undertake could adversely affect our business, financial condition, results of operations and cash flows. Divestitures may involve significant uncertainty and execution complexity, which may cause us not to achieve our strategic objectives, realize expected cost savings, or obtain other benefits from the divestiture. The significant risks and uncertainties involved in divestitures may include: •the inability to sell such businesses or assets on satisfactory price and terms and in a timely manner, including potentially long and costly sales processes and unsuccessful attempts by a buyer to receive required regulatory approvals, satisfy other conditions to closing, or obtain equity or debt financing in order to satisfy its payment obligations related to the transaction, •disruption to other parts of our business and distraction of management, •loss of key teammates or clients, •exposure to contingencies, including, among other things, those arising from representations and warranties made to a buyer regarding the businesses being sold, or •ongoing obligations to support the businesses following such divestitures, including through transition services arrangements, and other adverse financial impacts. Whether such divestitures are completed or not, their pendency could have a number of negative effects on our current business, including potentially disrupting our regular operations and diverting the attention of our workforce and management team. It could also disrupt existing business relationships, make it harder to develop new business relationships, or otherwise negatively impact the way that we operate our business. In the event of a termination of a divestiture transaction before it is consummated, the payment of a termination fee may not fully compensate us for our losses. Truist has businesses other than banking that are subject to a variety of risks. Truist is a diversified financial services company. This diversity subjects the Company’s earnings to a broader variety of risks and uncertainties. Other businesses in addition to banking that the Company operates include insurance brokerage, investment banking, securities underwriting and market making, loan syndications, investment management and advice and retail and wholesale brokerage services offered through the Company’s subsidiaries. These businesses entail significant market, operational, credit, compliance, technology, legal and other risks that could adversely impact the Company’s results of operations.

Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment. Embedded within strategic risks are risks associated with: •maintaining a level of earnings appropriate to support growth objectives and the ability to maintain dividends in various economic cycles, •successful delivery of innovation and technology strategies that transform the client experience as well as the way Truist conducts business, •changes and events within the external environment, including geopolitical, macroeconomic, social, cultural, competitive, and regulatory factors, and •implementation and execution of climate risk management related programs. Any of the foregoing may impact the successful execution of Truist’s strategy. Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services. Truist operates in a highly competitive industry that could become even more competitive with growth in areas such as neo-banks, fintechs, and other non-bank platforms. Increased competition could arise from technological advancements, legislative and regulatory changes, as well as competition from other financial services companies, some of which may be subject to less extensive regulation than Truist. The Company’s success depends, in part, on the Company’s ability to adapt its offering of products and services to evolving industry standards and client expectations. The widespread adoption of new technologies has required and will continue to require substantial investments to modify existing products and services or to develop new products and services. In addition, there is increasing pressure to provide products and services at lower prices further reducing contribution margins. The Company may not be successful in introducing new products and services in response to industry trends or developments in technology or those new products may not achieve market acceptance. Truist also competes with nonbank companies inside and outside of the Company’s market area and, in some cases, with companies other than those traditionally considered financial sector participants. In particular, technology companies are increasingly focusing on the financial sector, either in partnership with competitor banking organizations or on their own. These companies generally are not subject to the same regulatory oversight as main street financial institutions and may accordingly realize certain cost strategies and offer products and services at more favorable rates and with greater convenience to the client. This competition could result in the loss of clients and revenue in areas where fintechs are operating. As the pace of technology and change advance, continuous innovation is expected to exert long-term pressure on the financial services industry. The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality and cryptocurrencies could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure. Truist may not be able to complete future mergers or acquisitions. The Company must generally satisfy a number of meaningful conditions before completing an acquisition of another bank or BHC, including federal and state regulatory approvals. In determining whether to approve a proposed bank or BHC acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition; financial condition and future prospects, including current and projected capital ratios and levels; the competence, experience and integrity of management; record of compliance with laws and regulations; the convenience and needs of the communities to be served, including the acquiring institution’s record of compliance under the CRA; the effectiveness of the acquiring institution in combating money laundering activities; and public comments from various stakeholders. In addition, U.S. regulators must take systemic risk to the U.S. financial system into account when evaluating whether to approve a potential acquisition transaction involving a large financial institution like Truist. There is no certainty as to when or if or on what terms and conditions, any required regulatory approvals will be granted for any potential acquisition. In specific cases, Truist may be required to sell banks or branches or take other actions as a condition to receiving regulatory approval. An inability to satisfy other conditions necessary to consummate an acquisition transaction, such as third-party litigation, a judicial order blocking the transaction or lack of shareholder approval, could also prevent the Company from completing an announced acquisition. There has been increased scrutiny of bank and financial institution acquisitions from regulators and government entities in recent years. Refer to the “Acquisitions” section within Item 1 “Business” for additional discussion. Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist Financial Corporation 31 Truist has businesses other than banking that are subject to a variety of risks. Truist is a diversified financial services company. This diversity subjects the Company’s earnings to a broader variety of risks and uncertainties. Other businesses in addition to banking that the Company operates include insurance brokerage, investment banking, securities underwriting and market making, loan syndications, investment management and advice and retail and wholesale brokerage services offered through the Company’s subsidiaries. These businesses entail significant market, operational, credit, compliance, technology, legal and other risks that could materially adversely impact the Company’s results of operations.

•The Company may incur damages, fines, penalties, and other negative consequences from past, current, or future regulatory or other legal violations, including inadvertent or unintentional violations. •Pending or threatened legal proceedings and other matters may adversely affect the Company’s business, financial condition, results of operations, and reputation.

•The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations. •Legal proceedings may adversely affect the Company’s results, reputation, and business operations.

The levels of or changes in interest rates could affect our results of operations and financial condition. We are highly dependent on net interest income, which is the difference between interest income on earning assets, such as loans and investments, and interest expense on deposits and borrowings. Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies, general economic and market conditions, including high or increasing levels of inflation, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future, including future changes in interest rates. We may be adversely affected by policies, laws, and events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), depressing the interest rates associated with our earning assets to levels near the rates associated with our interest expense, increasing the volatility of market rates of interest, including the rate of change, or changing the spreads among different interest rate indices. The levels of or changes in interest rates could adversely affect us beyond our net interest income, including by increasing the cost or decreasing the availability of deposits or other variable-rate funding instruments, reducing the return on or demand for loans or increasing the prepayment speed of loans, increasing client or counterparty delinquencies or defaults and reducing the value of our loans, retained interests in securitizations, and fixed-income securities in our investment portfolio and the efficacy of our hedging strategies. Certain investment securities, notably MBS, are very sensitive to changes in rates. Generally, when rates rise, market values will decline, prepayments will decrease and the duration of MBS will increase. Conversely, when rates fall, market values will rise, prepayments of principal and interest will increase and the duration of MBS will decrease. The level of and changes in market rates of interest and, as a result, these risks and uncertainties, are beyond our control. The dynamics among these risks and uncertainties are also challenging to assess and manage. For example, while an accommodative monetary policy may benefit us to some degree by spurring economic activity among our clients, such a policy may ultimately cause us more harm by inhibiting our ability to grow or sustain net interest income. A rising interest rate environment can pose different challenges, such as potentially slowing the demand for credit, increasing delinquencies and defaults, and reducing the values of our loans and fixed income securities. Market volatility in interest rates, including the rate of change, can create particularly difficult conditions. Refer to the “Market Risk” section of the MD&A and “Note 19. Derivative Financial Instruments.” Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 The Company’s hedging strategies may not be successful in mitigating our interest rate, foreign exchange, and market risks, which could adversely affect our financial results. The Company employs various hedging strategies to mitigate the interest rate, foreign exchange, and market risks inherent in many of our assets and liabilities. The Company’s hedging strategies rely considerably on assumptions and projections regarding our assets and liabilities as well as general market factors. If any of these assumptions or projections prove to be incorrect or our hedges do not adequately mitigate the impact of changes in interest rates, foreign exchange rates, and other market factors, the Company may experience volatility in our earnings that could adversely affect our profitability and financial condition. In addition, the Company may not be able to find market participants that are willing to act as its hedging counterparties on acceptable terms or at all, which could have an adverse effect on the success of ours hedging strategies. The Company’s hedging strategies are not designed to eliminate all interest rate, foreign exchange, and market risks. The political environment and monetary and fiscal policies could adversely affect us. A fractious or volatile political environment in the U.S., including any related social unrest, could negatively impact business and market conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which in turn could cause our business and financial results to suffer. In addition, disruptions in the foreign relations of the United States could adversely affect industries and markets on which our business depends. We also could be negatively impacted by political scrutiny of the financial-services industry in general or our business or operations in particular, whether or not warranted, and by an environment where criticizing financial-services providers or their activities is politically advantageous. Changes in monetary and fiscal policies, including FRB policies, can adversely affect every facet of our business and operations—for example, the conditions for commercial and consumer lending, the creditworthiness of our clients, the cost of our deposits and other interest-bearing liabilities, and the yield on our earning assets— and cannot be controlled or predicted by the Company. FRB policies can: •meaningfully influence the availability and demand for loans and deposits, the rates and other terms for loans and deposits, and the conditions in equity, fixed-income, currency, and other markets; •significantly impact the cost of funds, as well as the return on assets, both of which can have an impact on interest income; •adversely affect the value of financial assets and liabilities; •adversely affect borrowers through higher debt servicing costs and potentially increase the risk that they may fail to repay their loan obligations; and •artificially inflate asset values during prolonged periods of accommodative policy, which could in turn cause volatile markets and rapidly declining collateral values during times of restrictive monetary and fiscal policies. During 2022 and 2023, the FRB raised interest rates significantly and shrank its balance sheet in response to inflation measures that were well above the FRB’s two percent target. Sustained higher interest rates and continued FRB asset reductions may adversely affect market stability, market liquidity and the Company’s financial performance and condition. Truist cannot predict the nature or timing of future changes in monetary policies or the precise effects such changes may have on the Company’s activities and financial results. In addition, tax and other fiscal policies impact not only general economic and market conditions but also give rise to incentives and disincentives that affect how we and our clients prioritize objectives, deploy resources, and run households and operate businesses. For example, developments related to the U.S. federal debt ceiling, including the possibility of a government shutdown, default by the U.S. government on its debt obligations, or related credit-rating downgrades, could have adverse effects on the broader economy, disrupt access to capital markets, and contribute to, or worsen, an economic recession. Inflation could negatively impact our business and financial results. Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention. Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer. 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation 22 Truist Financial Corporation Financial results, lending, and other business activities could be adversely affected by weak or deteriorating economic conditions. Our businesses are driven by robust economic and market activity, monetary and fiscal stability, and positive investor, business, and consumer sentiment. A prolonged period of slow growth in the U.S. economy as a whole or in any regional markets that Truist serves, or any deterioration in economic conditions or the financial markets may disrupt or dampen the economy, which could adversely affect the Company’s financial condition and results. If economic conditions deteriorate, the Company may see lower demand for loans by creditworthy clients, reducing the Company’s interest income. In addition, if unemployment levels increase or if real estate prices decrease, the Company could incur higher charge-offs and may incur higher expenses in connection with adverse conditions in the reasonable and supportable forecasts used to estimate the allowance for credit losses in accordance with CECL requirements. These conditions may adversely affect not only consumer borrowers but also commercial and industrial and commercial real estate borrowers, especially for those businesses that rely on the health of industries or properties that may suffer from deteriorating economic conditions. The ability of these borrowers to repay their loans may be reduced, causing the Company to incur higher credit losses. The deterioration of economic conditions also could adversely affect financial results for the Company’s fee-based businesses. Truist earns fee income from, among other activities, managing assets for clients, and providing brokerage and other investment advisory and wealth management services. Investment management fees are often based on the value of assets under management and a decrease in the market prices of those assets could reduce the Company’s fee income. Changes in stock or fixed income market prices or client preferences could affect the trading activity of investors, reducing commissions and other fees earned from the Company’s brokerage business. Poor economic conditions and volatile or unstable financial markets would likely adversely affect the Company’s capital markets-related businesses. In addition, recent events impacting the banking industry, including the bank failures in the first half of 2023, have resulted in significant disruption and volatility in the capital markets, reduced current valuations of securities portfolios and bank stocks, and decreased confidence in banks among depositors and other counterparties as well as investors. These events occurred in the context of rapidly rising interest rates which, among other things, have resulted in unrealized losses in longer duration debt securities and loans held by banks, increased competition for deposits and potentially increased the risk of a recession. A decrease in the supply of deposits or significant increase in competition for deposits could result in substantial increases in costs to retain and service deposits. Increased adoption of consumer banking technology can result in reduced deposit demand due to the relative ease with which depositors may transfer deposits to a different depository institution in the event that the Bank’s products and services are less competitive or confidence is lost in the Bank. The cost of resolving the recent bank failures has also prompted the FDIC to issue a special assessment to recover costs to the DIF. Refer to the “Regulatory Considerations” section in Item 1 “Business” for additional details related to the FDIC’s special assessment. Geopolitical conditions, military conflicts, acts or threats of terrorism, and related volatility and instability in global economic and market conditions could adversely affect us. Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have an adverse effect on the Company’s results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the U.S. and other nations remain uncertain and could adversely impact economic and market conditions for the Company and its clients and counterparties. Global conflicts present destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. Financial markets may be adversely affected by the current or anticipated impact of military or global conflicts, terrorism, or other geopolitical events. This could magnify inflationary pressure and extend any prolonged period of higher inflation.

Changes in interest rates could adversely affect revenue and expenses, the value of assets and liabilities, as well as the availability and cost of capital, and liquidity. Truist’s balance sheet can be sensitive to movements in market interest rates and spreads. In addition to the impact of the general economy, changes in interest rates or in valuations in the debt or equity markets could directly impact the Company in one or more of the following ways: •The yield on earning assets and rates paid on interest-bearing liabilities may change in disproportionate ways; or •The value of financial instruments held could change adversely. National, regional, and local economic conditions, competitive pressures and the policies of regulatory authorities affect interest income and interest expense. When interest rates rise, funding costs may rise faster than the yield the Company earns on assets, causing net interest margin to contract. Higher interest rates may also result in lower mortgage production income and elevated charge-offs in certain categories of the loan portfolio. Conversely, when interest rates fall, the yield the Company earns on assets may fall faster than the Company’s ability to lower rates paid on deposits or borrowings. Certain investment securities, notably MBS, are very sensitive to changes in rates. Generally, when rates rise, market values will decline, prepayments will decrease and the duration of MBS will increase. Conversely, when rates fall, market values will rise, prepayments of principal and interest will increase and the duration of MBS will decrease. The monetary and fiscal policies of the U.S. federal government could have a material adverse effect on profitability. Changes in monetary and fiscal policies, including FRB policies, can adversely affect profitability and cannot be controlled or predicted by the Company. FRB policies can: •significantly impact the cost of funds, as well as the return on assets, both of which can have an impact on interest income; •materially affect the value of financial assets and liabilities; •adversely affect borrowers through higher debt servicing costs and potentially increase the risk that they may fail to repay their loan obligations; and •artificially inflate asset values during prolonged periods of accommodative policy, which could in turn cause volatile markets and rapidly declining collateral values during times of restrictive monetary and fiscal policies. The FRB raised interest rates significantly and began shrinking its balance sheet during 2022 in response to inflation measures that were well above the FRB’s two percent target. The Federal Reserve may further increase interest rates in the near term. Sustained higher interest rates and continued FRB asset reductions may adversely affect market stability, market liquidity and the Company’s financial performance and condition. Truist cannot predict the nature or timing of future changes in monetary policies or the precise effects such changes may have on the Company’s activities and financial results. 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation Inflation could negatively impact our business, our profitability, and our stock price. Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention. Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer. Financial results, lending or other business activities could be materially affected by a deterioration of economic conditions. A prolonged period of slow growth in the U.S. economy as a whole or in any regional markets that Truist serves, or any deterioration in economic conditions or the financial markets may disrupt or dampen the economy, which could adversely affect the Company’s financial condition and results. If economic conditions deteriorate, the Company may see lower demand for loans by creditworthy clients, reducing the Company’s interest income. In addition, if unemployment levels increase or if real estate prices decrease, the Company could incur higher charge-offs and may incur higher expenses in connection with adverse conditions in the reasonable and supportable forecasts used to estimate the allowance for credit losses in accordance with CECL requirements. These conditions may adversely affect not only consumer borrowers but also commercial and industrial and commercial real estate borrowers, especially for those businesses that rely on the health of industries or properties that may suffer from deteriorating economic conditions. The ability of these borrowers to repay their loans may be reduced, causing the Company to incur higher credit losses. The deterioration of economic conditions also could adversely affect financial results for the Company’s fee-based businesses. Truist earns fee income from, among other activities, managing assets for clients, and providing brokerage and other investment advisory and wealth management services. Investment management fees are often based on the value of assets under management and a decrease in the market prices of those assets could reduce the Company’s fee income. Changes in stock or fixed income market prices or client preferences could affect the trading activity of investors, reducing commissions and other fees earned from the Company’s brokerage business. Poor economic conditions and volatile or unstable financial markets would likely adversely affect the Company’s capital markets-related businesses. Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition. Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the U.S. and other nations remain uncertain and could adversely impact economic and market conditions for the Company and its clients and counterparties. The war in Ukraine presents destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. In addition, global demand for products may exceed supply during the economic recovery from the COVID-19 pandemic, and such shortages may cause inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as the Company’s financial condition and results. Financial markets may be adversely affected by the current or anticipated impact of military conflict, including the war in Ukraine, terrorism, or other geopolitical events. This could magnify inflationary pressure resulting from the pandemic and other sources and extend any prolonged period of higher inflation. The replacement of LIBOR could adversely affect Truist’s profitability and financial condition. A transition away from the widespread use of LIBOR to alternative rates and other potential interest rate benchmark reforms will continue over the course of the next year. The publication of the one-week and two-month U.S. dollar LIBOR settings ceased as of December 31, 2021, while certain U.S. dollar LIBOR tenors are expected to continue to be published until June 30, 2023. A group of market participants convened by the FRB, the ARRC, has selected SOFR as its recommended alternative to U.S. dollar LIBOR. Truist offers SOFR-based lending solutions to wholesale and consumer clients and enters into SOFR-based derivative contracts. The passage of the Adjustable Interest Rate (LIBOR) Act by Congress, and the Federal Reserve’s implementing rule, should decrease the risk of contracts that are not remediated prior to the cessation deadline by providing the terms for a transition to SOFR. Truist is also supporting “credit sensitive” alternatives, such as Bloomberg Short-Term Bank Yield and other alternatives as they develop in the market. Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 Truist Financial Corporation 21 SOFR or other alternative reference rates may perform differently than LIBOR in response to changing market conditions. For example, SOFR could experience greater decreases during times of economic stress, which could require the Company to lend at lower rates at times when the Company’s borrowing costs are increasing. The market transition away from LIBOR to alternative reference rates is complex and could have a range of adverse effects on the Company’s business, financial condition, and results of operations. In particular, any such transition could: •adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of the Company’s LIBOR-based assets and liabilities; •adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of other securities or financial arrangements, given LIBOR’s role in determining market interest rates globally; •prompt inquiries or other actions from regulators in respect of the Company’s preparation and readiness for the replacement of LIBOR with an alternative reference rate; and •result in disputes, litigation, or other actions with borrowers or counterparties about the interpretation and enforceability of certain fallback language in LIBOR-based contracts and securities. The transition away from LIBOR to alternative reference rates has required the transition to or development of appropriate systems, models, and analytics to effectively transition the Company’s risk management and other processes from LIBOR-based products to those based on the applicable alternative reference rate, such as SOFR. Truist has developed a LIBOR transition team and project plan to address the transition. Truist has largely completed its assessment of risks related to the transition from LIBOR and continues its remediation efforts. There can be no guarantee that these efforts will successfully mitigate the operational risks associated with the transition away from LIBOR to an alternative reference rate. The manner and impact of the transition from LIBOR to an alternative reference rate, as well as the effect of these developments on the Company’s funding costs, loan, investment securities, and derivative portfolios, as well as ALM, is uncertain.

•Truist is subject to extensive and evolving government regulation and supervision, which could adversely affect our business, financial condition, results of operations, and prospects. •Regulatory capital and liquidity standards and future revisions to them may negatively impact our business and financial results. •Truist is subject to risks related to originating and selling loans, including repurchase and indemnification obligations. •Truist faces risks as a servicer of loans. •Truist faces substantial risks in safeguarding personal and other sensitive information. •Differences in regulation and supervision can affect the Company’s ability to compete effectively. •The Company can face risks of non-compliance and incur additional operational and compliance costs under laws relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption.

•Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions. •Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders. •Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers. •Truist faces risks as a servicer of loans. •Truist faces substantial legal and operational risks in safeguarding personal information. •Differences in regulation can affect the Company’s ability to compete effectively. •The Company can face risks of non-compliance and incur higher operational and compliance costs under laws and regulations relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption.

•Our inability to retain and grow deposits or a change in deposit costs or mix could negatively impact our funding strategy and financial results. •Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or an inability to monetize liquid assets. •A disruption in our access to the mortgage secondary market and GSEs for liquidity could negatively affect us. •The Company’s cost of funding or access to the banking and capital markets could be adversely affected if our credit ratings are downgraded or otherwise fail to meet investor expectations. •The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends. •The financial system is highly interrelated, and financial or systemic shocks or the failure of even a single financial institution or other participant in the financial system could adversely impact us.

•Loss of deposits or a change in deposit mix could increase Truist’s funding costs. •Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets. •Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity. •Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets. •The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress. •Truist may be impacted by the soundness of other financial institutions.

•Truist depends on the experience and expertise of key teammates. If these individuals were to leave or change their roles without effective replacements, our business and operations may suffer. •We could be harmed by an inability to attract, develop, retain, and motivate qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions. •The Company’s operations rely on its ability, and the ability of key external parties, to maintain appropriately staffed workforces and on the competence, trustworthiness, health, and safety of employees. 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation 20 Truist Financial Corporation

•Truist depends on the expertise of key teammates. If these individuals leave or change their roles without effective replacements, operations may suffer. •The Company depends on the ability to attract and retain qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions in order to implement and execute upon business strategies. •The Company’s operations rely on its ability, and the ability of key external parties, to maintain appropriately staffed workforces, and on the competence, trustworthiness, health and safety of employees.

•The Company is subject to credit risk by lending, committing to lend money, and entering into letters of credit and other types of contracts with counterparties and the Company’s allowance for loan losses may not be adequate to cover actual losses. •The Company may have more credit risk and higher credit losses if our underwriting standards and practices are inadequate, we adopt more liberal underwriting standards for competitive or other reasons, or our concentration and other risk limits are not well calibrated. •The Company may suffer losses if the value of collateral declines in weak, deteriorating, or stressed economic or market conditions.

•The Company is subject to credit risk by lending, committing to lend money, or entering into a letter of credit or other types of contracts with counterparties. •The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral. •The Company may suffer losses if the value of collateral declines in stressed market conditions.

•The Company and its suppliers face a wide array of cybersecurity risks, including risks of insider threats and third-party cybersecurity incidents, which could result in the loss of operational capabilities or the disclosure of confidential, proprietary, personal, and other sensitive information, which could have an adverse impact on the Company’s operations, financial condition, and prospects, as well as cause significant reputational damage and legal and financial exposure. •The Company’s operating systems and infrastructure, as well as operational capabilities managed or supplied by third parties on whom we rely, could fail or be interrupted, compromised, or breached, which could disrupt the Company’s business and adversely impact the Company’s operations, financial condition, and prospects, as well as cause significant reputational damage and legal and financial exposure. •Truist is heavily reliant on technology, and a failure to effectively anticipate, develop, and implement new technology could harm us. •The Company faces risks associated with the quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes. Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19

•The Company faces cybersecurity risks, including denial of service, phishing, malware and ransomware attacks, potential insider threats, and third-party cybersecurity incidents, which could result in the disclosure of confidential information, adversely affect the Company’s operations, cause reputational damage, and create significant legal and financial exposure. •The Company’s operational capabilities managed or supplied by third parties could fail, be compromised, or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, and financial condition, as well as cause legal exposure or reputational harm. •Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology. •The Company faces risks associated with quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes.

•Our business and operations make extensive use of models, and we could be adversely affected if our design, implementation, or use of models is flawed. •We use estimates and assumptions in determining the value or amount of many of our assets and liabilities, and our business, financial condition, results of operations, and prospects could be adversely affected if these prove to be incorrect. •Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

•There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators. •The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain. •Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill. Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19 Truist Financial Corporation 19

•Negative public opinion, whether real or perceived, or our failure to successfully manage it could damage the Company’s reputation and adversely impact our business, financial condition, results of operations, and prospects. •Truist may face reputational risks arising out of Truist’s sales, training, incentive compensation or business practices, products or services, or other activities of its teammates, representatives, or business partners.

•Negative public opinion could damage the Company’s reputation and adversely impact business and revenues. •Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues.

•Ineffective execution of strategic initiatives could adversely affect investor sentiment and our business and financial results. •Competition may reduce Truist’s client base or cause Truist to modify the pricing or other terms for products and services, which could have an adverse impact on our business and financial results. •Acquisitions, mergers, and divestitures introduce a broad range of anticipated and unanticipated risks, including unforeseen or negative consequences from supervisory or regulatory action that may limit Truist’s ability to pursue and complete them. •Truist has businesses other than banking that are subject to a variety of risks.

•Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment. •Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services. •Truist may not be able to complete future mergers or acquisitions. •Truist has businesses other than banking that are subject to a variety of risks.