Our corporate legal structure at December 31, 20202021 consisted of one domestic subsidiary bank, including its subsidiaries, and 5154 active non-bank subsidiaries, in addition to various affordable housing investments and historic rehabilitation investments. Our bank subsidiary is PNC Bank, a national bank headquartered in Pittsburgh, Pennsylvania. For additional information on certain of our subsidiaries, see Exhibit 21 to this Report.

Among the areas that have been receiving a high level of regulatory focus are compliance with the BSA and anti-money laundering laws, capital and liquidity management (including stress testing), the structure and effectiveness of enterprise risk management frameworks, the management of risks associated with the COVID-19 pandemic, the protection of confidential customer information, cyber security, the oversight of arrangements with third-party vendors and suppliers, and compliance with fair lending and other consumer protection laws and regulations, including those governing retail sales practices, fee disclosures, unfair, deceptive or abusive acts or practices, collection practices, and protections for military service members and individuals in bankruptcy.

In 2019, the federal banking agencies adopted rules to better tailor the application of their capital, liquidity and enhanced prudential requirements for banking organizations to the asset size and risk profile (as measured by certain regulatory metrics) of the banking organization (the “2019 Tailoring Rules”). Effective January 1, 2020, the agencies’ capital and liquidity rules classify all BHCs with $100 billion or more in total assets into one of four categories (Category I, Category II, Category III and Category IV), with the most stringent capital and liquidity requirements applying to Category I firms and the least restrictive requirements applying to Category IV firms. The classification of any bank subsidiary of a BHC generally follows that of its parent BHC. PNC and PNC Bank currently are Category III firms because PNC (i) has more than $250 billion, but less than $700 billion, in consolidated total assets, (ii) is not designated as a GSIB, and (iii) has less than $75 billion in cross-jurisdictional activity. PNC and PNC Bank would become a Category I or II institution, and subject to more stringent capital and liquidity standards, if PNC were at some point in the future to have $700 billion or more in total consolidated assets, be designated as a GSIB, or have $75 billion or more in cross-jurisdictional activity. As of December 31, 2020,2021, PNC had cross-jurisdictional activities for these purposes of $13.3$21.4 billion. PNC does not expect the pending acquisition of BBVA, if consummated, would affect its classification as a Category III institution.

We refer to the capital ratios calculated using the definition of capital under the agencies’ Basel III capital rules and, for the risk-based ratios, standardized risk-weighted assets, as our Basel III regulatory capital ratios.

The Federal Reserve and the OCC have provided guidance regarding incentive and other elements of compensation provided to executives and other employees at banking organizations they regulate, both as general industry-wide guidance and guidance specific to select larger companies, including PNC. These guidelines are intended to ensure that the incentive compensation practices of covered banking organizations do not encourage excessive risk-taking. Dodd-Frank requires the Federal Reserve, the OCC, the FDIC, the SEC and two other regulatory agencies to adopt regulations governing incentive compensation provided by regulated financial services companies to their executives and other employees. These agencies jointly proposed regulations in 2011 and again in 2016 to implement these requirements. Final regulations have not been adopted.

Federal banking laws and regulations also apply a variety of requirements or restrictions on insured depository institutions with respect to brokered deposits. For instance, only a “well capitalized” insured depository institution may accept brokered deposits without prior regulatory approval. In addition, brokered deposits are generally subject to higher outflow assumptions than other types of deposits for purposes of the LCR. In December 2020, theThe FDIC finalizedhas issued rules that establish a new frameworkand guidance for determining whether deposits are considered “brokered.”

The regulations and requirements applicable to PNC Bank, as a provisionally registered CFTC swap dealer, have imposed and will continue to impose compliance burdens on PNC Bank and introduce additional legal risks (including as a result of applicable anti-fraud and anti-manipulation provisions and private rights of action). In addition, failure to comply with the “pay-to-play” regulations that govern our swap and municipal securities businesses could result in limitations on PNC Bank’s ability to conduct swap and municipal securities business with state or local governments and their authorities.

Part of PNC’s ability to compete effectively depends on our ability to attract new employees and retain and develop our existing employees. In support of our employees, our strategic human capital goals include:

In managing our employees, we focus on these key factors:

Risks Related to the COVID-19 Pandemic

Risks Related to the Economy and Other External Factors, Including Regulation

The PNC Financial Services Group, Inc. is a BHC and a financial holding company, with the Federal Reserve as its primary regulator. PNC Bank is a federally chartered bank, with the OCC as its primary regulator. In addition, our businesses are subject to regulation by multiple other banking, consumer protection, securities and derivatives regulatory bodies. We are also subject to the jurisdiction of criminal and civil enforcement authorities.

The Federal Reserve requires a BHC to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require PNC to commit resources to PNC Bank when doing so is not otherwise in the interests of PNC or its shareholders or creditors.

Federal law grants substantial supervisory and enforcement powers to federal banking regulators. The results of routine and non-routine supervisory or examination activities by our regulators, including actual or perceived compliance failures, could result in limitations on our ability to enter into certain transactions, engage in new activities, expand geographically, make acquisitions or obtain necessary regulatory approvals in connection therewith. These activities also could result

A failure to comply, or to have adequate policies and procedures designed to comply, with regulatory requirements and expectations exposes us to the risk of damages, fines and regulatory penalties and other regulatory or enforcement actions or consequences, such as limitations on activities otherwise permissible for us or additional requirements for engaging in new activities and could also injure our reputation with customers and others with whom we do business. We also rely on third parties who may expose us to compliance risk. A failure to comply with regulatory requirements or deficiencies in risk management practices could be incorporated in our confidential supervisory ratings which could limit PNC’s ability to expand or require additional approvals before engaging in certain business activities.

Recently there has been an increase in legislative and regulatory efforts to protect the privacy of consumer data. Significant examples include the General Data Protection Regulation of the European Union and the California Consumer Privacy Act. These initiatives, among other things, limit how companies can use customer data and impose obligations on companies in their management of such data. Financial services companies such as PNC necessarily gather, maintain and use a significant amount of customer data. These types of initiatives increase compliance complexity and related costs, result in significant financial penalties for compliance failures, and limit our ability to develop new products or respond to technological changes. Such legal requirements also could heighten the reputational impact of perceived misuses of customer data by us, our vendors or others who gain unauthorized access to our customer data. Other jurisdictions may adopt similar requirements that impose different and potentially inconsistent compliance burdens. The impacts will be greater to the extent requirements vary across jurisdictions.

In some cases, we develop internally the intellectual property embedded in the technology we use. In others, we or our vendors license it from others. Regardless of the source of the intellectual property, if another person or entity were deemed to own intellectual property rights infringed by our activities, we could be responsible for significant damages covering past activities and substantial fees to continue to engage in these types of activities. It also is possible that we could be prevented from using technology important to our business for at least a period of time. In such a circumstance, there may be no alternative technology for us to use or an appropriate alternative technology might be expensive to obtain. Protections offered by those from whom we license technology against these risks may be inadequate to cover fully any losses. Over time, there have been instances where technology used by PNC and other financial institutions has been alleged to have infringed patents held by others, and in some cases we, as well as other financial institutions, have suffered related losses.

We are faced with ongoing, bordering on continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened as a result of our remote work environment, which results in more access points to our network. Most corporate and commercial transactions are now handled electronically, and our retail customers increasingly use online access and mobile devices to bank with us. The ability to conduct business with us in this manner depends on the transmission and storage of confidential information in electronic form. As a result, efforts by bad actors to engage in various types of cyber attacks pose serious risks to our business and reputation. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial apps, on behalf of our customers. These risks also arise to the extent that third parties with whom we do business are subject themselves to breaches and attacks which may impact our systems.

In the ordinary course of business, we maintain and process vast amounts of information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive. The highly sensitive information includes information sufficient to support identity theft and personal health information, as well as information regarding business plans and financial performance that has not been made public. One way in which bad actors attempt to harm us is by seeking access to some of this confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers. In other cases, they seek to disrupt our ability to conduct our business, including by destroying or impairing our access to information maintained by us.

Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from the third party, including those offering financial apps. Although we take steps to provide safety and security for our customers’ transactions with us and their customer information to the extent they are utilizing their own devices or providing third parties access to their accounts, our ability to assure such safety and security is necessarily limited.

As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC issued cards to make purchases from those businesses, card account information often is provided to the business. If the business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts, but to date such losses have not been material to us.accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Over the last few years, several large companies disclosed that they had suffered substantial data security breaches compromising millions of user accounts and credentials. To date, our losses and costs related to these types of breaches, including those where some of the accounts affected were with PNC, have not been material. Other similar events in the

Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information. Ransomware

attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted or access is otherwise denied, accompanied by a demand for ransom to restore access to the data. To date, our losses and costs related to these types of attacks have not been material, but ransomware attacks have increased in recent years and there is no guarantee that future attacks will not be successful.

A number of companies have fallen victim to BEC scams in recent years. BEC scams involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. While we have not experienced material losses from BEC scams to date, some of our commercial customers have been victimized. Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered.

Other attacks in recent years have included DDoSdistributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. We (as well as other financial services companies) have been subject to such attacks.

In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done.

To date, while some of these types of attacks have succeeded against us to some extent, none of these types of attacks have had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us. And our efforts to prevent significant harm from attacks may be insufficient. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks. Our ability to protect confidential or proprietary information is even more limited with respect to information held by third parties. We may suffer reputational damage or legal liability for unauthorized access to customer information held by third parties, even if we were in fact not responsible for preventing such access and had no reasonable way of preventing it.

We have policies, procedures and systems (including cyber security and business continuity programs) designed to prevent or limit the effect of possible failures, interruptions or breaches in security of information systems. In recent years, we have devoted significant resources towards improving the reliability of our systems and their security against external and internal threats and expect to continue to do so in the future. We design our business continuity and other information and technology risk management programs to manage our capabilities to provide services in the case of an event resulting in material disruptions of business activities affecting our employees, facilities, technology or suppliers. We cannot guarantee the effectiveness of our policies, procedures and systems to protect us in any particular future situation, nor the effectiveness of our oversight of risk at third parties. Our ability to implement policies, procedures and systems designed to prevent or limit the effect of possible failures, interruptions or breaches in security of information systems with respect to third party systems and the financial services industry infrastructure is necessarily limited. Should an adverse event affecting another company’scompany��s systems occur, we may not have financial protection from the other company sufficient to compensate us or otherwise protect us from the consequences.

Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas around the world. As a result, we may be unable to implement adequate preventive measures to address these methods in advance of attacks.

Even with our proactive and defensive measures in place, adverse events are likely to occur, and there remains the risk that one or more such events would be material to PNC. Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our business continuity planning, our ability to understand threats to us from a holistic perspective, and our ability to anticipate the timing and nature of any such event that occurs, with novel or unusual events posing a greater risk. It is also the case that an adverse event can go undetected for a period of time, with the adverse consequences likely greater the longer it takes to discover the

Credit risk is inherent in the financial services business. It results from, among other things, extending credit to customers, purchasing securities, and entering into financial derivative transactions and certain guarantee contracts. Credit risk is one of our most significant risks, particularly given the high percentage of our assets represented directly or indirectly by loans and securities and the importance of lending activity to our overall business. We manage credit risk by assessing and monitoring the creditworthiness of our customers and counterparties, by diversifying our loan portfolio, by obtaining and monitoring collateral for certain exposures and by investing primarily in high quality securities.

A borrower’s ability to repay a loan can be adversely affected by many factors. Individual borrowers can be affected, for example, by declines in income, job losses, health issues or family issues. Commercial borrowers can be affected, for example, by poor business performance, changes in customer behavior or catastrophic losses. Weakness in the economy or in financial markets would typically adversely impact the ability of our borrowers to repay outstanding loans. We are exposed to increased credit risk if we fail to evaluate properly at origination the likely ability of a borrower to repay a loan. Properly estimating the current and potential value of any collateral pledged to support the loan also is critical to effectively managing credit risk. A failure to identify declining creditworthiness of a borrower or declining collateral value at a time when remedial actions could reduce our exposure also increases credit risk. Any decrease in our borrowers’ ability to repay loans would result in higher levels of nonperforming loans, net charge-offs, provision for credit losses and valuation adjustments on loans held for sale. Managing credit risk effectively also relies on forecasts of future overall economic conditions, which are inherently imperfect.

In addition to credit risk associated with our lending activities, we have credit risk arising from many other types of business relationships. Routine transactions give us credit exposure to brokers and dealers, commercial banks, investment banks, mutual and hedge funds, other institutional clients, as well as vendors and other non-financial entities.

We reserve for credit losses on our loan and lease portfolio through our ACL estimated under CECL. Under CECL, the ACL reflects expected lifetime losses, which could lead to volatility in the allowance and the provision for credit losses as economic forecasts, actual credit performance and other factors used in the loss estimating process change. We also have reserves for unfunded loan commitments and letters of credit. Changes to expected losses are reflected in net income through provision for credit losses. An increase in credit risk would likely lead to an increase in provision for credit losses with a resulting reduction in our net income and would increase our allowance. An improvement of economic conditions or our economic outlook, particularly following a period of poor economic conditions, has and could continue to result in a recapture of provision for credit losses for a period of time with a resulting increase in our net income and decrease in our allowance that is not likely to be sustained.sustained and that may obscure actual current operations and financial performance.

The COVID-19 pandemic has adversely impacted both commercial borrowers and consumers. In addition, the declines in GDP and increases in unemployment associated with the pandemic, and responsive measures to manage it, have significantly impacted the economic and qualitative factors used for purposes of our estimation of credit losses under CECL. For a discussion of the increased credit risk arising from the pandemic and its impact to our estimation of credit losses, see the Risk Factor headed “The COVID-19 pandemic has had and is likely to continue to have an adverse effect, possibly materially, on our overall business and financial performance.”

As a result of the high percentage of our assets and liabilities that are in the form of interest-bearing or interest-related instruments, changes in interest rates, in the shape of the yield curve, or in spreads between different market interest rates can have a material effect on our business, our profitability and the value of our financial assets and liabilities. For example:

The rates on some interest-bearing instruments adjust promptly in accordance with changes in market rates, while others adjust only periodically or are fixed throughout a defined term. As a result, the impact of changes in interest rates can be either increased or diluted due to differences in the relative variability of the rates paid on our liabilities in relation to the rates received on our assets. The extent to which we have elected to hedge interest rate risk through interest rate swaps also affects the impact of rate changes. We attempt to manage the balance sheet to increase our benefit or reduce negative impacts from future movements in interest rates, but failures to anticipate actual movements may have the opposite result. In addition, we do not generally hedge all of our risk and the fact that we attempt to hedge any risk does not mean we will be successful.

While in general higher interest rates generally enhance our ability to grow our net interest income, there are risks associated with a rising interest rate environment. As a general matter, increasing rates tend to decrease the value of fixed-rate financial instruments held on our balance sheet, as discussed in the Risk Factor headed “Our business and financial performance are vulnerable to the impact of changes in the values of financial assets.” Also, customers may be less willing overall to borrow at higher rates. Higher interest rates may indirectly affect the value of asset classes such as real estate typically financed through secured loans, with a resulting negative effect on collateral securing such loans. As another example, there may be increased competitive pressures as rates on deposit products rise. The benefits of higher interest rates are best achieved if we can increase the rates on loans and other assets faster than the rates on deposits and other liabilities increase. We may not be able to achieve this result in a rising rate environment.

On the other hand, lower interest rates tend to have a negative impact on our net interest margin, and, unless offset by higher earning assets, on our net interest income. Moreover, a negative interest rate environment, in which interest rates drop below zero either broadly or for some types of instruments, could reduce our net interest margin and net interest income due to a likely decline in the interest we could earn on loans and other earning assets, while also likely requiring us to pay to maintain our deposits with the Federal Reserve Bank. In addition, our systems may not be able to handle adequately a negative interest rate environment and not all variable rate instruments are designed for such a circumstance. The current very low interest rate environment increases the potential for negative interest rates to occur.

We discuss the impact of governmental monetary policy on interest rates in the Risk FactorsFactor headed “The policies of the Federal Reserve and other governmental agencies have a significant impact on interest rates and overall financial market performance, which are important to our business and financial performance” and “The COVID-19 pandemic has had and is likely to continue to have an adverse effect, possibly materially, on our overall business and financial performance.”

As a financial institution, a substantial majority of our assets and liabilities are financial in nature. Examples include loans, securities, servicing rights, deposits and borrowings. Such assets and liabilities will fluctuate in value, often significantly, due to movements in the financial markets or market volatility as well as developments specific to the asset or liability in question. Credit-based assets and liabilities will fluctuate in value due to changes in the perceived creditworthiness of borrowers or other counterparties and also due to changes in market interest rates.

In many cases, we mark our assets and liabilities to market and recognize such changes either through net income or OCI. Thus, gains or losses on these assets and liabilities can have a direct impact on our results of operations, unless we have effectively hedged our exposures. We may need to record losses in the value of financial assets even where our expectation of realizing the face value of the underlying instrument has not changed. Other assets and liabilities are not marked to market. As a result, our balance sheet does not precisely represent the fair market value of our financial assets and liabilities.

In addition, asset management revenue is earned primarily based on a percentage of the value of the assets being managed and thus is impacted by general changes in market valuations. Thus, although we are not directly impacted by changes in the value of such assets, decreases in the value of those assets would affect related Noninterestnoninterest income.

Certain accounting policies require that we use estimates, assumptions and judgments whenin preparing our financial statements, including in determining credit loss reserves, reserves related to legal proceedings and the fair value of certain assets and liabilities, among other items. These policies require management to make difficult, subjective and complex judgments about matters that are measuredinherently uncertain and different amounts could be reported atunder different conditions or using different assumptions. For example, CECL requires us to make difficult, subjective and complex judgments about economic and market conditions in determining the ACL.

Some of our financial instruments, including certain derivatives, debt securities, loans, MSRs and private equity investments, among other items, require a determination of their fair value.value for our financial statements. Assets and liabilities carried at fair value inherently result in a higher degree of financial statement volatility. Changes in underlying factors or assumptions in any of the areas underlying our estimates could materially impact our future financial condition and results of operations. During periods of market disruption, it would be difficult to value certain assets if trading becomes less frequent and/or market data becomes less observable. There may be certain asset classes that were historically traded in active markets with significant observable data that rapidly become illiquid due to market volatility, a loss in market confidence or other factors. In addition, we have assets and liabilities carried at fair value that are estimated using unobservable inputs that are significant to the fair value of the assets or liabilities. The valuation of any asset or liability substantially based on unobservable inputs is necessarily less reliable than those based on active trading markets. Further, rapidly changing and unprecedented market conditions in any particular market could materially impact the valuation of assets as reported within our consolidated financial statements. Our ability to hedge exposure is in part dependent on our ability to value the related assets or liabilities.

We rely on quantitative models to measure risks and to estimate many financial values. We use models throughout much of our business, relying on them for much of our decision making. Examples of areas we use models include determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy, and calculating economic and regulatory capital levels. We also use models to estimate the value of financial instruments and balance sheet items. In particular, we depend significantly on complex models for credit loss accounting under CECL, many of which have only been in use for a relatively short period of time.CECL.

Models generally evaluate the performance of various factors under anticipated future conditions, relying on historical data to help build the model and in part on assumptions as to the future, often with respect to macro-economicmacroeconomic conditions, in order to generate the output. Poorly designed or implemented models, including in the choice of relevant historical data or future-looking assumptions, present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. Also, informationFor example, our models may not be effective if historical data does not accurately predict future events or if our models rely on erroneous data, formulas, algorithms or assumptions and our review processes fail to detect these flaws.

Information we provide to the public or to our regulators based on poorly designed or implemented models could be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distributionsdistribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models used is insufficient.

Our performance is subject to risks associated with declines in customer demand for our products and services. As a result of the nature of those products and services, we are particularly at risk for losses of economic confidence or customer trust in us. For a

Economic and market developments may affect consumer and business confidence levels. If customers lose confidence due to concerns regarding the economy, the demand for our products and services could suffer. We may also fail to attract or retain customers if we are unable to develop and market products and services that meet evolving customer needs or demands or if we are unable to deliver them effectively and securely to our customers. This is particularly true to the extent that our competitors are better able to do so.

Our ability to attract and retain customer deposits is impacted by the levels of interest rates, as customers balance the benefits of bank accounts such as deposit insurance and some of the convenience associated with more traditional banking products against the possibility of higher yields from other investments. In general, if the spread between the rates we offer and those offered by alternatives to bank accounts widens, customers are often willing to forego the benefits of bank accounts (such as FDIC insurance) for higher returns elsewhere. Our customers could remove money from checking, savings or other types of deposit accounts with us in favor of other banks or other types of cash management products. In such circumstances, we would need either to increase rates to levels that are seen as competitive or lose customers, in either case with a negative impact to net interest income. In addition, deposits are a low-cost source of funds for us. Therefore, losing deposits could increase our funding costs and reduce our net interest income. Loss of customers could also harm noninterest income by decreasing fee-bearing transaction volume. In addition, when rates are higher, customers tend to shift deposits from noninterest-bearing accounts to interest-bearing ones, thereby negatively impacting net interest income.

Our customers increasingly use third party financial applications that are expected to interface with their PNC accounts. This use leads to the risk that issues with respect to the effective functioning of that interface, regardless of cause, could result in a loss of customers as they seek banking relationships that work better with these other applications.

News or other publicity that harms our reputation, or harms the reputation of our industry generally, also could cause a loss of customers or a reduction in the extent to which customers do business with us. This is described further in the Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation.”

In our asset management business, investment performance is an important factor influencing the level of assets that we manage. Poor investment advice or performance could hurt revenue and growth as existing clients might withdraw funds in favor of better performing products. Additionally, the ability to attract funds from existing and new clients might diminish. Overall economic conditions may limit the amount that customers are able or willing to invest as well as the value of the assets they do invest. The failure or negative performance of products of other financial institutions could lead to a loss of confidence in similar products offered by us without regard to the performance of our products. Such a negative contagion could lead to withdrawals, redemptions and liquidity issues in such products and have an adverse impact on our assets under management and asset management revenues and earnings.

Our ability to compete effectively, to attract and retain customers and employees, and to grow our business is dependent on maintaining our reputation and having the trust of our customers and employees. Many types of developments, if publicized, can negatively impact a company’s reputation with adverse consequences to its business.

Financial services companies are highly vulnerable to reputational damage when they are found to have harmed customers, particularly retail customers, through conduct that is seen as illegal, unfair, deceptive, abusive, manipulative or otherwise wrongful. There also may be reputational damage from human error or systems failures viewed as having harmed customers but not involving misconduct, including service disruptions or negative perceptions regarding our ability to maintain the security of our technology systems and protect client data. Our reputation may also be harmed by failing to deliver products and services of the quality expected by our customers. The reputational impact is likely greater to the extent that the bad conduct, error or failure are pervasive, long-standing or affect a significant number of customers, particularly retail consumers. The negative impact of such reputational damage on our business may be disproportionate to the actual harm caused to customers. It may be severe even if we fully remediate any harm suffered by our customers. Furthermore, because we conduct most of our businesses under the “PNC” brand, negative public opinion about one business could also affect our other businesses. In addition, we could suffer reputational harm and a loss of customer trust as a result of conduct of others in the industry even where we have not engaged in the conduct. We use third parties to help in many aspects of our business, with the risk that their conduct can affect our reputation regardless of the degree to which we are responsible for it.

To an increasing extent, financial services companies, including PNC, are facing criticism from social and environmental activists, with accompanying reputational risk. Activists target companies in our industry, including PNC, for engaging in business with specific customers or with customers in particular industries, where the customers’ activities, even if legal, are perceived as having harmful impacts on matters such as environment, consumer health and safety, or society at large. In addition, other activists target companies in our industry, including PNC, seeking increased transparency and action with respect to diversityenvironmental, social and inclusion (including pay equity)governance activities, political activities and political activities.activities that are or may be perceived to be politically partisan in nature. Activist criticism has come in many forms, including protests at PNC facilities. PNC, together with many other financial services companies, have in recent years been criticized for financing companies engaged in, for example, extraction and distribution of fossil fuels, manufacture of nuclear and other weapons (including personal firearms), private prisons and border control activities. In contrast, recently state laws affecting our industry have been proposed and in some cases enacted reflecting the opposite approach. For example, to conduct most business with a municipality in Texas, PNC must certify, among other things, that it does not discriminate against the firearms industry or the fossil fuel industry. Many of these issues are divisive without broad agreement as to the appropriate steps a company such as PNC should take and often with strong feelings on both sides. As a result, however we respond to such criticism, we expose ourselves to the risks that current or potential customers decline to do business with us or current or potential employees refuse to work for us. This can be true regardless of whether we are perceived by some as not having done enough to address activist concerns or by others as having inappropriately yielded to activist pressures. Activist pressure can also be a factor in decisions as to which business opportunities and customers we pursue, potentially resulting in foregone profit opportunities. The OCC has requested comment

We may also face criticism, with accompanying reputational risk, from investors who are increasingly focused on a proposed rule that would prohibit large national banks, such as PNC Bank, from declining to provide credit or other products or services to customers engaged in lawful activities except for documented, pre-approved risk-related reasons. The rule, if adopted, could cause some customers to switch their business to other banks that are not subjectenvironmental, social and governance matters and the adequacy of companies’ responses to these restrictions or have other negative consequences on PNC’s businesses, operations and risk management activities.matters when making investment decisions.

The speed with which information now moves through social media and non-mainstreamother news sources on the internet means that negative information about PNC can rapidly have a broadly adverse impact on our reputation. This is true whether or not the information is accurate. Once information has gone viral, it can be hard to counter it effectively, either by correcting inaccuracies or communicating remedial steps taken for actual issues. The potential impact of negative information going viral means that material reputational harm can result from a single discrete or isolated incident.

We are also subject to the risk of reputational harm resulting from conduct of persons identified as our employees but acting outside of the scope of their employment, including through their activities on personal social media.

We are subject to intense competition both from other financial institutions and from non-bank entities, including financial technology companies (often referred to as FinTech). In many cases, non-bank entities can engage in many activities similar to ours or offer products and services desirable to our customers without being subject to the same types of regulation, supervision and restrictions as are applicable to banks.banks, which could place us at a competitive disadvantage. Emerging financial technologies, including with respect to payment services, lending and digital and crypto currencies, may affect our customers’ needs and expectations for products and services. We may fail to attract or retain customers if we are unable to develop and market products and services that meet evolving customer needs or demands or if we are unable to deliver them effectively and securely to our customers. This is particularly true to the extent that our competitors are better able to do so. We may also fail to attract or retain customers if we are unwilling to provide products or services that we deem to be speculative or risky. The competition we face is described in Item 1 of this Report under “Competition.”

Consolidation in our industry, including among smaller banks combining to form more competitive larger ones and between banks and non-bank entities, could result in PNC facing more intense competition, particularly in impacted regions or with respect to particular products.

A failure to adequately address the competitive pressures we face could make it harder for us to attract and retain customers across our businesses. On the other hand, meeting these competitive pressures could require us to incur significant additional expense or to accept risk beyond what we would otherwise view as desirable under the circumstances. In addition, in our interest rate sensitive businesses, competitive pressures to increase rates on deposits or decrease rates on loans could reduce our net interest margin, negatively impacting our net interest income.

We are a large company that offers a wide variety of products and services to a broad and diverse group of customers. We rely on our employees to design, manage, and operate our systems and controls to assure that we properly enter into, record and manage

As a result of our necessary reliance on employees, whether ours or those of third parties, to perform these tasks and manage resulting risks, we are thus subject to human vulnerabilities. These range from innocent human error to misconduct or malfeasance, potentially leading to operational breakdowns or other failures. Our controls may not be adequate to prevent problems resulting from human involvement in our business, including risks associated with the design, operation and monitoring of automated systems. We may also fail to adequately develop a culture of risk management among our employees.

Errors by our employees or others responsible for systems and controls on which we depend and any resulting failures of those systems and controls could result in significant harm to PNC. This could include customer remediation costs, regulatory fines or penalties, litigation or enforcement actions or limitations on our business activities. We could also suffer damage to our reputation, as described under “We are at risk for an adverse impact on our business due to damage to our reputation.”

We use automation, machine learning, artificial intelligence and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. TheseAutomated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Not only bad or missing data but also anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.

Our use of third parties to support our business needs typically means that we do not directly control the activities we are having them perform. Any disruption in services provided by these third parties could adversely affect our ability to conduct our business. Replacing third parties could also entail significant delay and expense. Risks can arise through greater complexity and inadequate performance by the third party (including by their downstream service providers), specifically where that performance could affect us or our customers.customers, and even when the result of factors or events are beyond such third party’s control. Many of the kinds of risks presented by activities performed by third parties are described elsewhere in these Risk Factors. For example, we use outside companies to assist us in processing some confidential customer or employee information. In such a case, a cyber attack on such a company may result in access to our customers’ or employees’ information. We are also vulnerable, including to regulatory penalties, where an outside company fails to comply with legal requirements relevant to its work on our behalf. We may in any such circumstance suffer financial losses, legal consequences and injury to our reputation. Even if the other company makes us whole for financial losses, which is not necessarily the case, it is unlikely that it would be able to restore any injury to our reputation. As a result, the use of third parties to assist in our business activities heightens the risks to us inherent in those activities.

Many aspects of our business involve substantial risk of legal liability. We have been named or threatened to be named as defendants in various lawsuits arising from our business activities. In addition, we are regularly the subject of governmental investigations and other forms of regulatory inquiry. We also are at risk when we have agreed to indemnify others for losses related to legal proceedings

they face, such as in connection with the sale of a business or assets by us. The results of these legal proceedings could lead to significant monetary damages or penalties, restrictions on the way in which we conduct our business or reputational harm.

Acquisitions of other companies or of financial assets and related deposits and other liabilities present risks and uncertainties to us in addition to those presented by the nature of the business acquired. These risks and uncertainties are found in the pending acquisition of BBVA, including its U.S. banking subsidiary, BBVA USA, and its integration into PNC following closing.

Specific factors that can affect the ultimate results from acquisitions include, depending on the nature of the business acquired, the following: