The PNC Financial Services Group, Inc. (PNC) 10-K2022 FY Annual report

Subsidiaries

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services company, certain elements of risk are inherent in what we do and the business decisions we make. Thus, we encounter risk as part of the normal course of our business, and we design risk management processes to help manage these risks.

Our success is dependent on our ability to identify, understand and manage the risks presented by our business activities so that we can appropriately balance risk taking with revenue generation and profitability. We discuss our principal risk management oversight and processes and, in appropriate places, related historical performance and other metrics in the Risk Management section of this Report.

The following are the material risk factors that affect us of which we are currently aware. Any one or more of these risk factors could have a material adverse impact on our business, financial condition, results of operations or cash flows. In addition, these risks present other possible adverse consequences, including those described below. These risk factors and other risks we face are also discussed further in other sections of this Report. Thus, the risk factors below should not be considered a complete list of potential risks that we may face.

The following is a summary of the Risk Factors in this Item 1A:

As a financial services company, our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S.

Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns and higher inflation and unemployment. This may be further exacerbated by the expiration of pandemic-related government assistance in the U.S., which could lead to a decrease in economic activity and a deterioration in households’ finances, particularly if consumers also continue to face high inflation. In addition, periods of inflation may affect certain of our costs or expenses (including increasing our cost of capital and labor), erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services.

While the U.S. economy has generally improved since the onset of the COVID-19 pandemic, we now operate in an uncertain economic environment as a result of the impacts of the pandemic and responsive measures to manage it, high inflation, supply chain disruptions, changes in the labor markets, volatile energy prices and geopolitical tensions (including as a result of the Russia-Ukraine conflict). These conditions may not abate in the near term, and their continuation could materially adversely affect our operations and financial performance. Such economic conditions also have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally depending on the nature and severity of the adverse economic conditions.

Given the geographic scope of our business and operations, we are most exposed to issues within the U.S. economy and financial markets. Our foreign business activities continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business more than nominally. We are, however, susceptible to the risk that foreign economic conditions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S.

Throughout the remainder of this Risk Factors section, we address specific ways in which economic issues could create risk for us and result in adverse impacts on our business and financial performance.

Some of the legislation responsive to the COVID-19 pandemic (such as the CARES Act and the Consolidated Appropriations Act that provided for certain commercial and consumer protections) altered the profitability of the transactions in which we engage, and other laws related to employee benefits increased administrative, compensation and benefits costs to us. Other such laws may be enacted in response to other extraordinary events beyond PNC’s control that have similar or broader effects on us and could adversely affect our financial condition and results of operations, possibly materially, in other ways that are not now known to us.

Concern regarding the ability of Congress and the President collectively to reach agreement on federal budgetary matters (including the debt ceiling), or prolonged stalemates leading to total or partial governmental shutdowns, also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance. Divided control of the U.S. government may increase concern over the inability of Congress and the President to reach necessary agreements and make government shutdowns or defaults in government obligations more likely.

The monetary policies of the Federal Reserve, including changes in the federal funds rate, open market operations and balance sheet management, have a significant impact on interest rates, the value of financial instruments and other assets and liabilities, and overall financial market performance and volatility. These policies can thus affect the activities and results of operations of financial

companies such as PNC. An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments.

The FOMC has increased its benchmark rates from a range of 0% to 0.25% from March 2020 through 2021 to 4.75% as of February 1, 2023 in an effort to reduce high rates of inflation. Although we may not accurately predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results, we anticipate that the FOMC will increase the federal funds rate by an additional 25 basis points in March. This would bring the federal funds rate to a range of 4.75% to 5.00% by mid-March. We expect a federal funds rate cut of 25 basis points in early 2024 as inflation moves toward the FOMC’s 2% long-term objective.

In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above.

Some of the potential impacts on our business and results of governmental monetary policy are described in Risk Factors under the heading “Risks Related to the Business of Banking.”

The PNC Financial Services Group, Inc. is a BHC and a financial holding company, with the Federal Reserve as its primary regulator. PNC Bank is a federally chartered bank, with the OCC as its primary regulator. In addition, our businesses are subject to regulation by multiple other banking, consumer protection, securities and derivatives regulatory bodies. We are also subject to the jurisdiction of criminal and civil enforcement authorities.

As a result, we are subject to numerous laws and regulations, with multiple regulators or agencies having supervisory or enforcement oversight over aspects of our business activities. These laws, regulations and supervisory activities are intended to promote the safety and soundness of financial institutions, financial market stability, the transparency and liquidity of financial markets, consumer protection and to prevent money laundering and terrorist financing and are not primarily intended to protect PNC security holders. In addition to regulation in the U.S., we are also subject to foreign regulation to a limited extent as a result of our business activities outside the U.S.

Applicable laws and regulations restrict our permissible activities and investments and require compliance with provisions designed to protect loan, deposit, brokerage, fiduciary, and other customers, and for the protection of customer information, among other things. We also are subject to laws and regulations designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities. Over time, the scope of the laws and regulations affecting our businesses, as well as the number of requirements or limitations imposed by legislative or regulatory actions, has increased, and we expect to continue to face substantial regulatory oversight and new or revised regulatory requirements or initiatives. Legislative or regulatory actions can result in increased compliance costs, reduced business opportunities, or new requirements and limitations on how we conduct our business. In particular, the financial services industry continues to face heightened scrutiny, particularly with respect to BSA and AML compliance requirements and consumer compliance and protection matters. For example, under Dodd-Frank, the CFPB has broad authority to protect consumers from “unfair, deceptive and abusive acts or practices,” the definition of which is being clarified through heightened instances of CFPB enforcement actions and proceedings.

The Federal Reserve requires a BHC to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require PNC to commit resources to PNC Bank when doing so is not otherwise in the interests of PNC or its shareholders or creditors.

Federal law grants substantial supervisory and enforcement powers to federal banking regulators. The results of routine and non-routine supervisory or examination activities by our regulators, including actual or perceived compliance failures, could result in limitations on our ability to enter into certain transactions, engage in new activities, expand geographically, make acquisitions or obtain necessary regulatory approvals in connection therewith, or otherwise require us to modify our businesses practices in a manner that materially impacts our financial condition or results of operations. These activities also could result in significant fines, penalties or required corrective actions, some of which could be expensive and difficult to implement. In addition, another financial institution’s violation of law or regulation may give rise to an investigation of the same or similar activities of PNC.

As we expand our product and service offerings into additional markets, domestic or foreign, either through organic growth or acquisition, we have faced and will continue to face increases in state or foreign regulation affecting our operations. Different approaches to regulation by different jurisdictions could materially increase our compliance costs or risks of non-compliance.

A failure to comply, or to have adequate policies and procedures designed to comply, with regulatory requirements and expectations exposes us to the risk of damages, fines and regulatory penalties and other regulatory or enforcement actions or consequences, such as limitations on activities otherwise permissible for us or additional requirements for engaging in new activities and could also injure our reputation with customers and others with whom we do business. We also rely on third parties who may expose us to compliance

risk. A failure to comply with regulatory requirements or deficiencies in risk management practices could be incorporated in our confidential supervisory ratings, which could limit PNC’s ability to expand or require additional approvals before engaging in certain business activities.

See the immediately following Risk Factor for a discussion of risks associated with capital and liquidity regulation. Also see the Supervision and Regulation section of this Report for more information concerning the regulation of PNC, including those areas that have been receiving a high level of regulatory focus. Note 20 Regulatory Matters also discusses some of the regulations applicable to us.

PNC and PNC Bank are subject to regulatory capital and liquidity requirements established by the Federal Reserve and the OCC, respectively. These regulatory capital and liquidity requirements are typically developed at an international level by the Basel Committee and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies can apply stricter capital and liquidity standards than those developed by the Basel Committee. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations.

Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as the limitations on distributions imposed in response to the COVID-19 pandemic and the 2007-2008 financial crisis. In addition, dividends from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations.

Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective.

The Basel Committee continues to develop policies and standards for the prudential regulation of banks. See the Supervision and Regulation section of this Report. Generally, as it is unclear whether or how these initiatives will be implemented in the U.S., we are unable to estimate what potential impact such initiatives may have on us. We expect the federal banking agencies to propose rules in 2023 to implement the capital- and liquidity-related final set of Basel III standards issued by the Basel Committee in December 2017.

Regulatory capital and liquidity requirements are subject to regular review and revision by the Basel Committee and the U.S. banking agencies. For example, under the 2019 Tailoring Rules, certain BHCs are classified as Category I, Category II, Category III or Category IV firms. While PNC and PNC Bank currently are Category III firms, if PNC or PNC Bank became a Category I or II institution, we would be subject to more stringent capital and liquidity standards, which would likely increase some of the potential adverse effects described above. Future changes to the capital and liquidity rules to require PNC or PNC Bank to maintain more or higher quality capital or greater liquidity would also likely increase some of the potential adverse effects described above.

The regulatory capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, are discussed in the Supervision and Regulation section of this Report and the Liquidity and Capital Management portion of the Risk Management section of this Report.

Our credit ratings are based on a number of factors, including the financial strength of PNC and PNC Bank, and factors outside of our control, such as conditions affecting the financial services industry generally. Reductions in one or more of our credit ratings could adversely affect our ability to borrow funds and increase our cost of capital and limit the number of investors or counterparties willing to do business with or lend to us. For example, downgrades could negatively impact our right to continue to service mortgages. Downgrades could also adversely affect our ability to attract or retain customers, including deposits. In addition, a downgrade in our credit ratings could trigger obligations to make cash or collateral payments under derivative contracts with certain counterparties. There can be no assurance that we will maintain our current ratings and outlooks. For information on our credit ratings, see the Liquidity and Capital Management portion of the Risk Management section of this Report.

A significant portion of our transactions involve variable or adjustable interest rates that are calculated by adding a contractually defined credit spread to a base or reference rate. Until recently, LIBOR was the reference rate used for a substantial majority of our transactions involving variable or adjustable interest rates, including those in which we lend money, issue securities, or purchase and sell securities issued by others, as well as many derivative transactions that we enter into to manage our or our customers’ risk. We also service variable or adjustable-rate financial instruments entered into by others that have historically commonly used LIBOR as the reference rate. Based upon guidance communicated by the Federal Reserve and other official sector representatives, PNC stopped entering into new USD LIBOR contracts as of December 31, 2021, subject to certain limited exceptions. However, we maintain a sizable book of owned and serviced LIBOR reference rate assets. For more information on our LIBOR reference rate assets, see the Market Risk Management portion of the Risk Management section of this Report.

Currently, SOFR is the alternative reference rate replacing USD LIBOR for most types of transactions and, under recently enacted federal legislation addressing LIBOR cessation, is the replacement reference rate to be used for certain LIBOR contracts when LIBOR cessation occurs, including those that do not include terms for determining a replacement reference rate. LIBOR and SOFR are based on different inputs. LIBOR is intended to reflect the borrowing cost of certain global banks, while SOFR is derived from rates on overnight U.S. Treasury repurchase transactions, which are essentially overnight loans secured by U.S. Treasury securities. To address differences between LIBOR and SOFR, certain industry-recommended LIBOR contract provisions that provide a mechanism to transition to a SOFR reference rate include the concept of an adjustment spread. The adjustment spread is applied when a LIBOR-based contract moves to the SOFR replacement reference rate. These recommended adjustment spreads are based on a five-year median look-back of the historical spot difference between the applicable LIBOR tenor and the applicable SOFR tenor and were fixed on March 5, 2021 as a result of announcements by ICE Benchmark Administration (the administrator of LIBOR) and the UK Financial Conduct Authority (the regulatory supervisor of the IBA) of the dates after which all LIBOR settings will either cease to be provided or will no longer be representative. The same adjustment spreads will also be operational under current federal law.

Changing the reference rate to SOFR is highly likely to result in some value transfer between parties to instruments originally based on LIBOR, and we have experienced some value transfer in connection with instruments that have been amended away from LIBOR in anticipation of its cessation. That value transfer arises because no reference rate will replicate LIBOR exactly, and, accordingly, any replacement reference rate will not behave identically to LIBOR over time.

Any value transfer could be financially adverse or beneficial to us or to the other contracting parties (such as a borrower, derivative counterparty or bond holder). Impacts from a change in reference rate would likely include changes to the yield on, and value of, loans or securities held by us, amounts paid on securities we have issued, amounts received and paid on derivative instruments we have entered into and the trading market for LIBOR-based securities. Any theoretical benefit to us could result in counterparty dissatisfaction, which could impair relationships that result in loss of business or could lead to litigation (potentially as class actions). As a result, over the life of a transaction that transitions from LIBOR to a replacement reference rate, our monetary obligations to a counterparty (or its obligations to us) and the yield we receive (or pay) from the transaction with that counterparty may change from that which would have resulted from a continuation of LIBOR.

Another set of risks associated with LIBOR cessation relates to how the transition from LIBOR to another rate will be implemented. For some instruments, the method of transitioning to a replacement reference rate may be challenging, especially where the contract does not provide for a transition upon LIBOR ceasing or becoming a nonrepresentative rate, or where the relevant contractual language relating to a potential transition is ambiguous or inadequate under the circumstances.

We have other contracts that do contemplate the cessation or nonrepresentative status of LIBOR, but they do so in manners that may create other risks. For example, some contracts provide for selecting replacement rates in a manner that presents significant challenges (such as by assuming that there would be a rate calculated substantially in the same manner as LIBOR is calculated) or that gives us or another party absolute discretion to select a replacement reference rate. Some provide for determination of a replacement reference rate without providing for use of an adjustment spread to account for the difference in the reference rates. In these types of cases, there will likely be uncertainty surrounding transition, in addition to all of the risks described in this Risk Factor.

Transitioning from LIBOR to alternative reference rates also may result in operational errors during the transition such that the replacement rate is not applied in a timely manner or is incorrectly applied. This is particularly true given the volume of contracts that will require transition, the diversity of potential approaches to transition and the possibility that the period during which the transition will need to take place may have a short duration. Our failure to successfully implement the transition from LIBOR to alternative reference rates increases the risk of regulatory scrutiny and actions by our regulators, including fines and other supervisory sanctions. It is also possible that LIBOR quotes will become unavailable prior to the currently anticipated cessation dates. In that case, the risks associated with the transition to an alternative reference rate will be accelerated and magnified. These risks may also be increased due to the shorter time for preparing for the transition.

Transitioning from LIBOR to alternative reference rates also impacts certain of our hedge accounting strategies. Uncertainty about the application of ASC 848 Reference Rate Reform to pooled cash flow hedge strategies introduces accounting risk that could affect our ability to apply this accounting in the future. See Note 1 Accounting Policies for more information about reference rate reform accounting standards impacts.

To address LIBOR cessation and the associated risks, we have established an enterprise LIBOR transition program. Any failure of this program to appropriately assess and mitigate risk and deliver in a timely manner on operationalizing our ability to transition from LIBOR to alternative reference rates could magnify the risks previously outlined.

Recently, there has been an increase in legislative and regulatory efforts to protect the privacy of personal data, including enhanced data privacy laws regulating the use of health and biometric data. Individuals whose personal information may be protected by law may include our customers, prospective customers, job applicants, employees and third parties. These initiatives, among other things, limit how companies can use personal data and impose obligations on companies in their management of such data. Financial services companies such as PNC necessarily gather, maintain and use a significant amount of personal data. These types of initiatives increase compliance complexity and related costs, may result in significant financial penalties for compliance failures, and may limit our ability to develop new products or respond to technological changes. This is particularly true as we continue to expand our business into new markets. We are, or may become, subject to regularly evolving and developing data privacy and data security laws and regulations in other jurisdictions, including certain foreign jurisdictions even where our presence in such jurisdictions is minimal. Such legal requirements also could heighten the reputational impact of perceived misuses of personal data by us, our vendors or others who gain unauthorized access to our personal data. Other jurisdictions may adopt similar requirements that impose different and potentially inconsistent compliance burdens. The impacts will be greater to the extent requirements vary across jurisdictions.

There continues to be concern, including on the part of our regulators, regarding climate change and its impacts on virtually all aspects of life over the short-, medium- and long-term horizons. These concerns over the anticipated and unanticipated impacts of climate change (including physical risk and transition risk) have led and will continue to lead to governmental efforts around the world to mitigate those impacts. We and our customers may face cost increases, asset value reductions, operations disruptions and changes and the like because of climate change (including severe weather events) and governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses are also changing their behaviors because of these concerns. Changed consumer and business behavior because of climate change concerns creates transition risk for PNC arising from the process of adjusting to these concerns, including transitioning to a low-carbon economy. PNC and its customers will need to respond to new laws and regulations as well as consumer and business preferences as a result. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. We also have been and may continue to be subject to pressure from individuals or groups to cease doing business with certain companies or sectors because of concerns related to climate change. We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Further, there is increased scrutiny of climate change-related policies, goals and disclosures, which could result in litigation and regulatory investigations and actions. We may incur additional costs and require additional resources as we evolve our strategy, practices and related disclosures with respect to these matters.

The Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation” further discusses risks associated with our management of environmental, social and governance matters, including related activist pressure. Our efforts to take these risks into account in making lending and other decisions may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior, including those resulting from activist pressure. Our risk management may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, virtual and augmented reality, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can make payments or manage their accounts. The emergence of many of these technologies was accelerated as a result of the COVID-19 pandemic and the shift to increased digital activity. We expect these trends to continue for the foreseeable future.

In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we have been investing in technology and connectivity. We are seeking to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved the expenditure of considerable amounts of funds and other resources. A failure to maintain or enhance our competitive position with respect to technology, whether because we fail to anticipate customer expectations, because our technological developments fail to perform as desired or are not rolled out in a timely manner, or because we fail to keep pace with our competitors, would likely cause us to lose market share or incur additional expense. Our ability to maintain or enhance our relative technological position is in part dependent on our ability to attract and retain talented employees in these fields, which, due to overall demand, is increasingly difficult.

In some cases, we develop internally the intellectual property embedded in the technology we use. In others, we or our vendors license the use of intellectual property from others. Regardless of the source of the intellectual property, if another person or entity were deemed to own intellectual property rights infringed by our activities, we could be responsible for significant damages covering past activities and substantial fees to continue to engage in these types of activities. It also is possible that we could be prevented from using technology important to our business for at least some period of time. In such circumstances, there may be no alternative technology for us to use or an appropriate alternative technology might be expensive to obtain. Protections offered by those from whom we license technology against these risks may be inadequate to cover any losses in full. Over time, there have been and continue to be instances where technology used by PNC and other financial institutions has been alleged to have infringed patents held by others, and, in some cases, we, as well as other financial institutions, have suffered related losses.

The need to ensure proper functioning and resiliency of our information systems and other technology has become more important and more challenging, and the costs involved in that effort continue to be high. Our ability to create, obtain, maintain and report on information in an accurate, timely and secure manner is a foundational component of our business. Effective management of our expanded remote work environment heightens our need for secure, reliable and adequate information systems and technology. The risks of operational failures in the use of these systems result from a variety of factors. We are vulnerable to the impact of failures of our systems to operate as needed or intended. Failures leading to materially adverse impacts could include those resulting from human error, unexpected transaction volumes, or overall security, design or performance issues. In addition, our ability to use our technology effectively could be impacted due to electrical or telecommunications outages, bad weather, disasters, bad actors, terrorism and the like. Such events could affect our systems directly or limit our ability to use our technology due to effects on key underlying infrastructure. In some cases, the risk results from the potential for bad acts on the part of others, discussed in more detail in the Risk Factor headed “We are vulnerable to the risk of third-party breaches of data security affecting the functioning of systems or the confidentiality of information, either at PNC or at third parties handling PNC information.”

We also rely on information systems maintained by other companies. We use other companies both to provide products and services directly to us and to assist us in providing products and services to our customers. Others provide the infrastructure that supports, for example, communications, payment, clearing and settlement systems, or information processing and storage. These companies range from those providing highly sophisticated information processing to those that provide fundamental services, such as electric power and telecommunications. In some cases, these other companies themselves utilize third parties to support their delivery of products and services to us and our customers. Systems maintained by or for these other companies are generally subject to many of the same risks

we face with respect to our systems and thus their issues could have a negative impact on PNC. We necessarily have less ability to provide oversight over other companies’ information systems.

A number of our customers choose to use financial applications that allow them to view banking and other financial account information, often held at different financial institutions, on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Financial applications often ask users to provide their secure banking log-in information and credentials (such as usernames and passwords) so the applications can link to users’ accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications. To do this, data aggregators are provided with customers’ log-in information and credentials, which allow the aggregators to access the customers’ online accounts and “scrape” the customers’ data, often on a daily or even more frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In some cases, cybercriminals appear to be using such data aggregators and integrators to facilitate account takeovers and fraudulent wires. PNC has and may continue to face increased financial exposure due to fraudulent activity associated with the increased use of these applications and data aggregators. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. Even where PNC does not have responsibility for fraud losses associated with any of these applications and data aggregators, PNC could suffer increased reputational harm when such losses occur.

The occurrence of any failure, interruption or security breach of any of our information or communications systems, or the systems of other companies on which we rely, could result in a wide variety of adverse consequences to us. This risk is greater if the issue is widespread, extends for a significant period of time, or results in financial losses to our customers. The consequences of failures to operate systems properly can result in disruptions to our critical business operations, including our ability to use our accounting, deposit, loan, payment and other systems. Such events could also cause errors in transactions or impair system functionality with customers, vendors or other parties. Possible adverse consequences also include damage to our reputation or a loss of customer business, which could occur even if the negative impact on customers was de minimis. We also could face litigation or additional regulatory scrutiny. This in turn could lead to liability or other sanctions, including fines and penalties or reimbursement of adversely affected customers. Even if we do not suffer any material adverse consequences as a result of events affecting us directly, information systems issues at other financial institutions could lead to a general loss of customer confidence in financial institutions, including us. Also, system problems, including those resulting from third-party attacks, whether at PNC or at our competitors, may broadly increase legislative, regulatory and customer concerns regarding the functioning, safety and security of such systems. In that case, we would expect to incur even higher levels of costs with respect to prevention and mitigation of these risks.

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened because of our increased remote work environment, which results in more access points to our network. Most corporate and commercial transactions are now handled electronically, and our retail customers increasingly use online access as well as mobile and cloud technologies to bank with us. The ability to conduct business with us in this manner depends on the transmission and storage of confidential information in electronic form. As a result, efforts by bad actors to engage in various types of cyber attacks pose serious risks to our business and reputation. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise to the extent that third parties with whom we do business are subject themselves to breaches and attacks, which may impact our systems.

In the ordinary course of business, we maintain and process vast amounts of information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive. Such highly sensitive information includes information sufficient to support identity theft and personal health information, as well as information regarding business plans and financial performance that has not been made public. One way in which bad actors attempt to harm us is by seeking access to some of this confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers. In other cases, they seek to disrupt our ability to conduct our business, including by destroying or impairing our access to information maintained by us.

Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and

their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions, and other internet-based financial product offerings.

As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts.

Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and may use this information to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information.

A number of companies have fallen victim to business email compromise scams in recent years. Business email compromise scams involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered.

Other attacks in recent years have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.”

The techniques used in cyber attacks change rapidly and frequently and are increasingly sophisticated, and we may not be able to anticipate cyber attacks or data security breaches.

In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the increase in the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access.

We are and have been the target of some of these types of cyber attacks. To date, none of these types of cyber attacks has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no assurance that future cyber attacks will not be material. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks. Our ability to protect confidential or proprietary information is even more limited with respect to information held by third parties. We may suffer reputational damage or legal liability for unauthorized access to customer information held by third parties, even if we were in fact not responsible for preventing such access and had no reasonable way of preventing it.

We have policies, procedures and systems (including cybersecurity and business continuity programs) designed to prevent or limit the effect of possible failures, interruptions or breaches in security of information systems. In recent years, we have devoted significant resources toward improving the reliability of our systems and their security against external and internal threats and expect to continue to do so in the future. We design our business continuity and other information and technology risk management programs to manage our capabilities to provide services in the case of an event resulting in material disruptions of business activities affecting our employees, facilities, technology or suppliers. We cannot guarantee the effectiveness of our policies, procedures and systems to protect us in any future situation, nor the effectiveness of our oversight of risk at third parties. Although we have policies, procedures and systems designed to mitigate third-party risk, our ability to implement policies, procedures and systems designed to prevent or

limit the effect of possible failures, interruptions or breaches in security of information systems with respect to third-party systems and the financial services industry infrastructure is necessarily limited. Should an adverse event affecting another company’s systems occur, we may not have financial protection from the other company sufficient to compensate us or otherwise protect us from the consequences.

Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas around the world. As a result, we may be unable to implement adequate preventive measures to address these methods in advance of attacks.

Even with our proactive and defensive measures in place, adverse events are likely to occur, and there remains the risk that one or more such events would be material to PNC. Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our business continuity planning, our ability to understand threats to us from a holistic perspective, and our ability to anticipate the timing and nature of any such event that occurs, with novel or unusual events posing a greater risk. It is also the case that an adverse event may go undetected for a period of time, with the adverse consequences likely greater the longer it takes to discover the problem. In many cases, it also depends on the preparedness and responses of national or regional governments, including emergency responders, or on the part of other organizations and businesses with which we deal. Additionally, our failure to communicate cyber incidents appropriately to relevant parties could result in regulatory, legal, operational and reputational risk.

Credit risk is inherent in the financial services business. It results from, among other things, extending credit to customers, purchasing securities, and entering into financial derivative transactions and certain guarantee contracts. Credit risk is one of our most significant risks, particularly given the high percentage of our assets represented directly or indirectly by loans and securities and the importance of lending activity to our overall business. We manage credit risk by assessing and monitoring the creditworthiness of our customers and counterparties, by diversifying our loan portfolio, by obtaining and monitoring collateral for certain exposures and by investing primarily in high quality securities.

A borrower’s ability to repay a loan can be adversely affected by many factors. Individual borrowers can be affected, for example, by declines in income, job losses, health issues or family issues. Commercial borrowers can be affected, for example, by poor business performance, changes in customer behavior or catastrophic losses. Weakness in the economy or in financial markets would typically adversely impact the ability of our borrowers to repay outstanding loans. We are exposed to increased credit risk if we fail to evaluate properly at origination the likely ability of a borrower to repay a loan. Properly estimating the current and potential value of any collateral pledged to support the loan also is critical to effectively managing credit risk. A failure to identify declining creditworthiness of a borrower or declining collateral value at a time when remedial actions could reduce our exposure also increases credit risk. Any decrease in our borrowers’ ability to repay loans likely would result in higher levels of nonperforming loans, net charge-offs, provision for credit losses and valuation adjustments on loans held for sale. Managing credit risk effectively also relies on forecasts of future overall economic conditions, which are inherently imperfect.

In addition to credit risk associated with our lending activities, we have credit risk arising from many other types of business relationships. Routine transactions give us credit exposure to brokers and dealers, commercial banks, investment banks, mutual and hedge funds, other institutional clients, as well as vendors and other non-financial entities.

Our credit risk may be exacerbated when the value of collateral held by us to secure obligations to us cannot be realized, including because of legal or regulatory changes, or is liquidated at prices that are not sufficient to recover the full amount of the loan or derivative exposure due to us. In addition, credit risk may be exacerbated when counterparties are unable to post collateral, whether for operational or other reasons.

We reserve for credit losses on our loan and lease portfolio through our ACL estimated under CECL. Under CECL, the ACL reflects expected lifetime losses, which has led and could continue to lead to volatility in the allowance and the provision for credit losses as economic forecasts, actual credit performance and other factors used in the loss estimating process change. We also have reserves for unfunded loan commitments and letters of credit. Changes to expected losses are reflected in net income through provision for credit losses. A worsening of economic conditions or our economic outlook or an increase in credit risk, particularly following a period of good economic conditions, would likely lead to an increase in provision for credit losses with a resulting reduction in our net income and an increase to our allowance. Conversely, an improvement of economic conditions or our economic outlook, particularly following a period of poor economic conditions, could result in a recapture of provision for credit losses for a period of time with a resulting increase in our net income and decrease in our allowance that is not likely to be sustained and that may obscure actual current operations and financial performance.

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by commercial and residential real estate typically represent a significant percentage of our overall credit portfolio. They also represent a portion of the assets underlying our investment securities. Although there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting specific

customers or counterparties, industries, geographies, asset classes or financial markets, including a decline in their creditworthiness or a worsening overall risk profile, could materially and adversely affect us. For example, any downturn in the condition of the U.S. housing market could result in significant write-downs of asset values tied to residential real estate. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries. Financial services institutions are interrelated because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

As a result of the high percentage of our assets and liabilities that are in the form of interest-bearing or interest-related instruments, changes in interest rates, in the shape of the yield curve, or in spreads between different market interest rates can have a material effect on our business, our profitability and the value of our financial assets and liabilities. For example:

The rates on some interest-bearing instruments adjust promptly in accordance with changes in market rates, while others adjust only periodically or are fixed throughout a defined term. As a result, the impact of changes in interest rates can be either increased or diluted due to differences in the relative variability of the rates paid on our liabilities in relation to the rates received on our assets. The extent to which we have elected to hedge interest rate risk through interest rate swaps also affects the impact of rate changes. We attempt to manage the balance sheet to increase our benefit or reduce negative impacts from future movements in interest rates, but failures to anticipate actual movements may have the opposite result. In addition, we do not generally hedge all of our risk and the fact that we attempt to hedge any risk does not mean we will be successful.

While higher interest rates generally enhance our ability to grow our net interest income, there are risks associated with a rising interest rate environment. As a general matter, increasing rates tend to decrease the value of fixed-rate financial instruments held on our balance sheet, as discussed in the Risk Factor headed “Our business and financial performance are vulnerable to the impact of changes in the values of financial assets.” Also, customers may be less willing or able overall to borrow at higher rates. Higher interest rates may indirectly affect the value of asset classes such as real estate typically financed through secured loans, with a resulting negative effect on collateral securing such loans. As another example, there may be increased competitive pressures as rates on deposit products rise. The benefits of higher interest rates are best achieved if we can increase the rates on loans and other assets faster than the rates on deposits and other liabilities increase. We may not be able to achieve this result in a rising rate environment.

On the other hand, lower interest rates tend to have a negative impact on our net interest margin, and, unless offset by higher earning assets, on our net interest income. Moreover, a negative interest rate environment, in which interest rates drop below zero either broadly or for some types of instruments, could reduce our net interest margin and net interest income due to a likely decline in the interest we could earn on loans and other earning assets, while also likely requiring us to pay to maintain our deposits with the Federal Reserve Bank. In addition, our systems may not be able to handle adequately a negative interest rate environment and not all variable rate instruments are designed for such a circumstance.

We discuss the impact of governmental monetary policy on interest rates in the Risk Factor headed “The policies of the Federal Reserve and other governmental agencies have a significant impact on interest rates and overall financial market performance, which are important to our business and financial performance.”

As a financial institution, a substantial majority of our assets and liabilities are financial in nature. Examples include loans, securities, servicing rights, deposits and borrowings. Such assets and liabilities will fluctuate in value, often significantly, due to movements in the financial markets or market volatility as well as developments specific to the asset or liability in question. The underlying value of assets under lease or securing an obligation generally decreases due to increases in supply or decreases in demand for the asset or deterioration in the condition of the asset. This could negatively impact the ability to collect fully on the secured obligation. Credit-based assets and liabilities will fluctuate in value due to changes in the perceived creditworthiness of borrowers or other counterparties and due to changes in market interest rates.

In many cases, we mark our assets and liabilities to market and recognize such changes either through net income or OCI. Thus, gains or losses on these assets and liabilities can have a direct impact on our results of operations and financial performance, unless we have

effectively hedged our exposures. We may need to record losses in the value of financial assets even where our expectation of realizing the face value of the underlying instrument has not changed. Our remaining assets and liabilities are not marked to market. As a result, our balance sheet does not precisely represent the fair market value of our financial assets and liabilities.

In addition, asset management revenue is earned primarily based on a percentage of the value of the assets being managed and thus is impacted by general changes in market valuations. Thus, although we are not directly impacted by changes in the value of such assets, decreases in the value of those assets would affect related noninterest income.

Our accounting policies are key to how we report our financial condition and results of operations. We must exercise judgment in selecting and applying many of these policies and methods to comply with GAAP and reflect management’s judgment regarding the most appropriate manner to report PNC’s financial condition and results of operations. Management’s selection of a particular accounting policy to apply, while reasonable and appropriate, could result in PNC reporting different results than would have been reported under a different alternative. In addition, the Financial Accounting Standards Board, SEC and other regulatory agencies may issue new or amend existing accounting and reporting standards or change existing interpretations of those standards that could materially affect our financial statements. In some cases, PNC may be required to retrospectively apply a new or amended standard resulting in changes to previously reported financial results.

Certain accounting policies require that we use estimates, assumptions and judgments in preparing our financial statements, including in determining credit loss reserves, reserves related to legal proceedings and the fair value of certain assets and liabilities, among other items. These policies require management to make difficult, subjective and complex judgments about matters that are inherently uncertain, and different amounts could be reported under different conditions or using different assumptions. For example, CECL requires us to make difficult, subjective and complex judgments about economic and market conditions in determining the ACL.

Some of our financial instruments, including certain derivatives, debt securities, loans, MSRs and private equity investments, among other items, require a determination of their fair value for our financial statements. Assets and liabilities carried at fair value inherently result in a higher degree of financial statement volatility. Changes in underlying factors or assumptions in any of the areas underlying our estimates could materially impact our future financial condition and results of operations. During periods of market disruption, it would be difficult to value certain assets if trading becomes less frequent and/or market data becomes less observable. There may be certain asset classes that were historically traded in active markets with significant observable data that rapidly become illiquid due to market volatility, a loss in market confidence or other factors. In addition, we have assets and liabilities carried at fair value that are estimated using unobservable inputs that are significant to the fair value of the assets or liabilities. The valuation of any asset or liability substantially based on unobservable inputs is necessarily less reliable than those based on active trading markets. Further, rapidly changing and unprecedented market conditions could materially impact the valuation of assets as reported within our consolidated financial statements. Our ability to hedge exposure is in part dependent on our ability to value the related assets or liabilities.

The determination of the amount of loss allowances and asset impairments varies by asset type and is based upon our periodic evaluation and assessment of known and inherent risks associated with the respective asset class. Management updates its evaluations regularly and reflects changes in allowances and impairments in operations as such evaluations are revised. Although we have policies and procedures in place to determine loss allowance and asset impairments, due to the subjective nature of this area, the level of impairments taken, and allowances reflected in our financial statements may not accurately reflect the actual level of risk and the amount of future losses.

We rely on models to measure risks and to estimate many financial values. We use models throughout many areas of our business, relying on them to inform decision making. Examples of areas where we use models include determining the pricing of various products, identifying potentially fraudulent transactions, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements.

Models generally predict or infer certain financial outcomes, leveraging historical data and assumptions as to the future, often with respect to macroeconomic conditions. Development and implementation of some of these models, such as the models for credit loss accounting under CECL, require us to make difficult, subjective and complex judgments. Poorly designed or implemented models, including in the choice of relevant historical data or forward-looking assumptions, present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. For example, our models may not be effective if historical data does not accurately represent future events or environments or if our models rely on erroneous data, formulas, algorithms or assumptions and our internal model review processes fail to detect and address these flaws.

Models, if flawed, could cause information we provide to the public or to our regulators to be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models we use is insufficient. Finally, flaws in our models that negatively

impact our customers or our ability to comply with applicable laws and regulations could negatively affect our reputation or result in fines and penalties from our regulators.

Our performance is subject to risks associated with declines in customer demand for our products and services. As a result of the nature of those products and services, we are particularly at risk for losses of economic confidence or customer trust in us.

Economic and market developments may affect consumer and business confidence levels. If customers lose confidence due to concerns regarding the economy, the demand for our products and services could suffer. If we fail to attract and retain customers, demand for our loans and other financial products and services could decrease, and we could experience adverse changes in payment patterns. We could lose interest income from a decline in credit usage and noninterest income from a decline in product sales, investments and other transactions.

Our ability to attract and retain customer deposits is impacted by the levels of interest rates, as customers balance the benefits of bank accounts such as deposit insurance and some of the convenience associated with more traditional banking products against the possibility of higher yields from other investments. In general, if the spread between the rates we offer and those offered by alternatives to bank accounts widens, customers are often willing to forego the benefits of bank accounts (such as FDIC insurance) for higher returns elsewhere. Our customers could remove money from checking, savings or other types of deposit accounts with us in favor of other banks or other types of cash management products. In such circumstances, we would need either to increase rates to levels that are seen as competitive or lose customers, in either case with a negative impact to net interest income. In addition, deposits are a low-cost source of funds for us. Therefore, losing deposits could increase our funding costs and reduce our net interest income. Loss of customers could also harm noninterest income by decreasing fee-bearing transaction volume. In addition, when rates are higher, customers tend to shift deposits from noninterest-bearing accounts to interest-bearing ones, thereby negatively impacting net interest income.

Our customers increasingly use third-party financial applications that are expected to interface with their PNC accounts. This use leads to the risk that issues with respect to the effective functioning of that interface, regardless of cause, could result in a loss of customers as they seek banking relationships that work better with these other applications.

News or other publicity that harms our reputation, or harms the reputation of our industry generally, also could cause a loss of customers or a reduction in the extent to which customers do business with us. This is described further in the Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation.”

In our asset management business, investment performance is an important factor influencing the level of assets that we manage. Poor investment advice or performance could hurt revenue and growth as existing clients might withdraw funds in favor of better performing products. Additionally, the ability to attract funds from existing and new clients might diminish. Overall economic conditions may limit the amount that customers are able or willing to invest as well as the value of the assets they do invest. The failure or negative performance of products of other financial institutions could lead to a loss of confidence in similar products offered by us without regard to the performance of our products. Such a negative contagion could lead to withdrawals, redemptions and liquidity issues in such products and have an adverse impact on our assets under management and asset management revenues and earnings.

Our ability to compete effectively, to attract and retain customers and employees, and to grow our business is dependent on maintaining our reputation and having the trust of our customers, employees, the communities that we serve and other stakeholders. Many types of developments, if publicized, can negatively impact a company’s reputation with adverse consequences to its business.

Financial services companies are highly vulnerable to reputational damage when they are found to have harmed customers, particularly retail customers, through conduct that is seen as illegal, unfair, deceptive, abusive, manipulative or otherwise wrongful. There also may be reputational damage from human error or systems failures viewed as having harmed customers without involving misconduct, including service disruptions or negative perceptions regarding our ability to maintain the security of our technology systems and protect client data. For example, we may suffer reputational harm to the extent that we are unable to successfully detect, prevent and remedy fraud that harms our clients. Our reputation may also be harmed by failing to deliver products and services of the quality expected by our customers and support the communities that we serve. In addition, our reputation may be harmed as a result of our participation in certain programs, such as the PPP and the processing of unemployment benefits during the COVID-19 pandemic, that has exposed and may continue to expose us to increased scrutiny and criticism. The reputational impact is likely greater to the extent that the bad conduct, errors or failures are pervasive, long-standing or affect a significant number of customers, particularly retail consumers. The negative impact of such reputational damage on our business may be disproportionate to the actual harm caused to customers. It may be severe even if we fully remediate any harm suffered by our customers. Furthermore, because we conduct most of our businesses under the “PNC” brand, negative public opinion about one business could also affect our other businesses. In addition, we could suffer reputational harm and a loss of customer trust as a result of the conduct of others in our industry even if we have not engaged in such conduct. We use third parties to help in many aspects of our business, with the risk that their conduct can affect our reputation regardless of the degree to which we are responsible for it.

The speed with which information moves through social media and other news sources on the internet means that negative information about PNC can rapidly have a broadly adverse impact on our reputation. This is true whether or not the information is accurate. False information can also be spread from unaffiliated or parody social media accounts pretending to be official company communications channels. Once information has gone viral, it can be difficult to counter it effectively, either by correcting inaccuracies or communicating remedial steps taken for actual issues. The potential impact of negative information going viral means that material reputational harm can result from a single discrete or isolated incident.

We are also subject to the risk of reputational harm resulting from conduct of persons identified as our employees but acting outside of the scope of their employment, including through their misconduct, unethical behavior, or activities on personal social media.

We are subject to intense competition both from other financial institutions and from non-bank entities, including financial technology companies (often referred to as “FinTech”). In many cases, non-bank entities can engage in many activities similar to ours or offer products and services desirable to our customers without being subject to the same types of regulation, supervision and restrictions that are applicable to banks, which could place us at a competitive disadvantage. Emerging financial technologies, including with respect to payment services and systems, lending, digital wallets, non-fungible tokens and digital currencies and cryptocurrencies, may affect our customers’ needs and expectations for products and services. We may fail to attract or retain customers if we are unable to develop and market products and services that meet evolving customer needs or demands or if we are unable to deliver them effectively and securely to our customers. We may also fail to attract or retain customers if we are unwilling to provide products or services that we deem to be speculative or risky. The competition we face is described in Item 1 of this Report under “Competition.”

Consolidation in our industry, including among smaller banks combining to form more competitive larger ones and between banks and non-bank entities, could result in PNC facing more intense competition, particularly in impacted regions or with respect to particular products. As we expand into new markets, we may face competitors with more experience and established relationships in these markets, which could adversely affect our ability to compete.

A failure to adequately address the competitive pressures we face could make it harder for us to attract and retain customers across our businesses. On the other hand, meeting these competitive pressures could require us to incur significant additional expense or to accept risk beyond what we would otherwise view as desirable under the circumstances. In addition, in our interest rate sensitive businesses, competitive pressures to increase rates on deposits or decrease rates on loans could reduce our net interest margin, negatively impacting our net interest income.

Our performance is dependent on attracting and retaining talented and diverse employees. We face significant competition for these employees across many of our businesses and support areas. This presents greater risk as we expand into new markets, develop new product lines, or enhance staffing in certain areas, particularly technology. This competition leads to increased expenses in affected business areas. In addition, changes to the labor market as a result of the COVID-19 pandemic (including elevated employee attrition, labor availability and wage inflation) have exacerbated and may continue to exacerbate the challenges of attracting and retaining talented and diverse employees. Differences in demands, expectations and priorities of the workforce (such as remote work expectations) may require us to modify our recruiting and retention strategies to attract and retain employees. Limitations on the way regulated financial institutions can compensate their officers and employees, including those contained in pending rule proposals implementing requirements of Dodd-Frank, may make it more difficult for regulated financial institutions, including PNC, to compete with unregulated companies for talent.

We are a large company that offers a wide variety of products and services to a broad and diverse group of customers. We rely on our employees to design, manage and operate our systems and controls to assure that we properly enter into, record and manage processes, transactions and other relationships with customers, suppliers and other parties with whom we do business. In some cases, we rely on employees of third parties to perform these tasks. We also depend on employees and the systems and controls for which they are responsible to assure that we identify and mitigate the risks that are inherent in our relationships and activities. These concerns are increased when we change processes or procedures, introduce new products or services, acquire or invest in a business or implement new technologies, as we may fail to adequately identify or manage operational risks resulting from such changes. These concerns may be further exacerbated by employee turnover and labor shortages.

As a result of our necessary reliance on employees, whether ours or those of third parties, to perform these tasks and manage resulting risks, we are thus subject to human vulnerabilities. These range from innocent human error to misconduct or malfeasance, potentially leading to operational breakdowns or other failures. Our controls may not be adequate to prevent problems resulting from human involvement in our business, including risks associated with the design, operation and monitoring of automated systems. We may also fail to adequately develop a culture of risk management among our employees.

Errors by our employees or others responsible for systems and controls on which we depend and any resulting failures of those systems and controls to prevent unethical, fraudulent, improper or illegal conduct could result in significant harm to PNC. This harm could include customer remediation costs, regulatory fines or penalties, litigation or enforcement actions or limitations on our business activities. We could also suffer damage to our reputation, as described under “We are at risk for an adverse impact on our business due to damage to our reputation.”

We use automation, machine learning, artificial intelligence and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. Automated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Not only bad or missing data but also anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.

Our use of third parties to support our business needs typically means that we do not directly control the activities we are having them perform. Any disruption in services provided by these third parties could adversely affect our ability to conduct our business. Replacing third parties could also entail significant delay and expense. Risks can arise through inadequate performance by a third party (including by its downstream service providers), specifically where that performance could affect us or our customers, and even when the result of factors or events are beyond such third party’s control. Many of the kinds of risks presented by activities performed by third parties are described elsewhere in these Risk Factors. For example, we use outside companies to assist us in processing some confidential customer or employee information. In such a case, a cyber attack on such a company may result in access to our customers’ or employees’ information. We are also vulnerable, including to regulatory penalties, if an outside company fails to comply with legal requirements relevant to its work on our behalf. We may in any such circumstance suffer financial losses, legal consequences and injury to our reputation. Even if the other company makes us whole for financial losses, which is not necessarily the case, it is unlikely that it would be able to restore any injury to our reputation. As a result, the use of third parties to assist in our business activities heightens the risks to us inherent in those activities.

Many aspects of our business involve substantial risk of legal liability. We have been named or threatened to be named as defendants in various lawsuits arising from our business activities. In addition, we are regularly the subject of governmental investigations and other forms of regulatory inquiry. We also are at risk when we have agreed to indemnify others for losses related to legal proceedings they face, such as in connection with the sale of a business or assets by us. The results of these legal proceedings could lead to significant monetary damages or penalties, restrictions on the way in which we conduct our business or reputational harm.

Although we establish accruals for legal proceedings when information related to the loss contingencies represented by those matters indicates both that a loss is probable and that the amount of loss can be reasonably estimated, we do not have accruals for all legal proceedings where we face a risk of loss. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, amounts accrued often do not represent the ultimate loss to us from the legal proceedings in question. Thus, our ultimate future losses may be higher, and possibly significantly so, than the amounts accrued for legal loss contingencies. We discuss further the unpredictability of legal proceedings and describe certain of our pending legal proceedings in Note 21 Legal Proceedings.

Acquisitions of other companies or of financial assets and deposits and other liabilities present risks and uncertainties to us in addition to those presented by the nature of the business acquired. Many of the same risks arise when we engage in strategic partnerships.

Specific factors that can affect the ultimate results from acquisitions include, depending on the nature of the business acquired, the following:

Neither the occurrence nor the potential impact of natural and other disasters (including severe weather events), health emergencies, dislocations, geopolitical instabilities, terrorist activities, international hostilities or other extraordinary events beyond PNC’s control can be predicted. However, these occurrences could adversely impact us, for example, by causing significant damage to our facilities or preventing us from conducting our business in the ordinary course. Also, their impact on our borrowers, depositors, other customers, suppliers or other counterparties could result in indirect adverse effects on us. Other indirect adverse consequences from these occurrences could result from impacts to the financial markets, the economy in general or in any region, or key parts of the infrastructure (such as the power grid) on which we and our customers rely. These types of indirect effects, whether specific to our counterparties or more generally applicable, could lead, for example, to an increase in delinquencies, bankruptcies or defaults that could result in PNC experiencing higher levels of nonperforming assets, net charge-offs and provisions for credit losses. They could also cause a reduction in demand for lending or other services that we provide.

Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our resiliency planning. This includes our ability to anticipate the nature of any such event that might occur. The adverse impact of these occurrences also could be increased to the extent that there is a lack of preparedness on the part of national or regional emergency responders or on the part of other organizations and businesses that we deal with, many of which we depend on but have limited or no control over.

Kieran J. Fallon was appointed Executive Vice President and Chief Risk Officer in February 2021. Prior to his appointment, he served as PNC’s Senior Deputy General Counsel with legal oversight responsibility for PNC’s government, regulatory affairs and enterprise risk, and as PNC’s primary liaison with PNC’s regulatory bodies. Previously, he served as PNC’s chief counsel of Regulatory Affairs and briefly as acting general counsel. Prior to joining PNC in 2011, Mr. Fallon served as associate general counsel for legislation and special projects with the Board of Governors of the Federal Reserve System in Washington, D.C.

Income Statement Highlights

We cannot provide, without unreasonable effort, a meaningful or accurate reconciliation of forward-looking non-GAAP measures to their most directly comparable GAAP financial measures. This is due to the inherent difficulty of forecasting the timing and amounts necessary for the reconciliation when such amounts are subject to events that cannot be reasonably predicted, as noted in our Cautionary Statement. Accordingly, we cannot address the probable significance of the unavailable information.

Table 3: Summarized Average Balances and Net Interest Income (a)