CINCINNATI FINANCIAL CORP

The business of insurance in the United States (U.S.) is primarily regulated by state law. All of our U.S. insurance company subsidiaries are domiciled in the state of Ohio except The Cincinnati Specialty Underwriters Insurance Company, which is domiciled in the state of Delaware. Each domestic insurance subsidiary is primarily governed by the insurance laws and regulations in its respective state of domicile. We also are subject to regulatory authorities of all states in which we write insurance. The state laws and regulations that have the most significant effect on our insurance operations and financial reporting are discussed below.

•Insurance Holding Company Regulation – We are regulated as an insurance holding company system in the respective states of domicile of our lead standard market property casualty company subsidiary and its surplus lines insurance subsidiary. These regulations require that we annually furnish financial and other information about the governance and operations of the individual companies within the holding company system. Information about the risks posed by any noninsurance company subsidiaries must also be disclosed. All transactions within a holding company system affecting insurers must be fair and equitable. Notice to the state insurance commissioner is required prior to the consummation of transactions affecting the ownership or control of an insurer and prior to certain material transactions between an insurer and any person or entity in its holding company group. In addition, some of those transactions cannot be consummated without the commissioner’s prior approval.

•Subsidiary Dividends – The Cincinnati Insurance Company is fully owned by Cincinnati Financial Corporation and is our lead insurance subsidiary. The dividend-paying capacity of The Cincinnati Insurance Company and its fully owned subsidiaries is regulated by the laws of the applicable state of domicile. Under these laws, our domestic insurance subsidiaries must provide a 10-day advance informational notice to the insurance commissioner for the domiciliary state prior to payment of any dividend or distribution to its shareholders. Generally, the most our domestic insurance subsidiaries can pay without prior regulatory approval is the greater of 10% of statutory capital and surplus or 100% of statutory net income for the prior calendar year.

The domestic insurance company subsidiaries must give 30 days of notice to, and obtain prior approval from, the state insurance commissioner before the payment of an extraordinary dividend as defined by the state’s insurance code. You can find information about the dividends paid by our lead insurance subsidiary during 2024 in Item 8, Note 9 of the Consolidated Financial Statements.

•Insurance Operations – All of our domestic insurance subsidiaries are subject to licensing and supervision by departments of insurance in the states in which they do business. The nature and extent of such regulations vary, but generally are rooted in statutes that delegate regulatory, supervisory and administrative powers to state insurance departments. Such regulations, supervision and administration of the domestic insurance subsidiaries include: the standards of solvency that must be met and maintained; the licensing of insurers and their agents and brokers; the nature and limitations on investments; deposits of securities for the benefit of policyholders; regulation of standard market policy forms and premium rates; policy cancellations and nonrenewals; test audit programs; periodic examination of the affairs of insurance companies; annual and other reports required to be filed on the financial condition of insurers or for other purposes; requirements regarding reserves for unearned premiums, losses and other matters; the nature of and limitations on dividends to policyholders and shareholders; the nature and extent of required participation in insurance guaranty funds; the involuntary assumption of hard-to-place or high-risk insurance business, primarily workers’ compensation insurance; and the collection, remittance and reporting of certain taxes and fees. Our primary insurance regulators in the U.S. have adopted the Model Audit Rule for annual statutory financial reporting. This regulation closely mirrors the Sarbanes-Oxley Act on matters such as auditor independence, corporate governance and internal controls over financial reporting. The regulation permits the audit committee of Cincinnati Financial Corporation’s board of directors to also serve as the audit committee of each of our insurance subsidiaries for purposes of this regulation.

•Insurance Guaranty Associations – For certain obligations of insolvent insurance companies to policyholders and claimants, states assess each member insurer in an amount relative to the insurer’s proportionate share of business written by all member insurers in the state. While the amount of such assessments has not been material in recent years, we cannot predict the amount and timing of any future assessments or refunds on our insurance subsidiaries under these laws.

Cincinnati Financial Corporation - 2024 10-K - Page 26

•Shared Market and Joint Underwriting Plans – Assigned risk plans, reinsurance facilities and joint underwriting associations are mechanisms that generally provide applicants with various basic insurance coverages when they are not available in voluntary markets. States can require participation based upon the amount of an insurance company’s voluntary market share, and underwriting results related to these pools could be adverse to our company.

•Statutory Accounting – For public reporting, domestic insurance companies prepare financial statements in accordance with GAAP. However, certain data also must be calculated according to statutory accounting rules as defined in the NAIC’s Accounting Practices and Procedures Manual. While not a substitute for any GAAP measure of performance, statutory data frequently is used by industry analysts and other recognized reporting sources to facilitate comparisons of the performance of insurance companies.

•Insurance Reserves – State insurance laws require that property casualty and life insurers annually analyze the adequacy of reserves. Our appointed actuaries must submit an opinion that reserves are adequate for policy claims-paying obligations and related expenses.

•Investment Regulation – Insurance company investments must comply with laws and regulations pertaining to the type, quality and concentration of investments. Such laws and regulations permit investments in federal, state and municipal obligations, corporate bonds, preferred and common equity securities, mortgage loans, real estate and certain other investments, subject to specified limits and other qualifications.

•Risk-Based Capital Requirements – The NAIC’s risk-based capital (RBC) requirements for property casualty and life insurers serve as an early warning tool for the NAIC and state regulators to identify companies that may be undercapitalized and may merit further regulatory action. The NAIC has a standard formula for annually assessing RBC. The formula for calculating RBC for property casualty companies takes into account asset and credit risks but places more emphasis on underwriting factors for reserving and pricing. The formula for calculating RBC for life insurance companies takes into account factors relating to insurance, business, asset and interest-rate risks.

Although the federal government and its regulatory agencies generally do not directly regulate the business of insurance, federal legislation and administrative rules adopted can affect our business. Privacy laws, such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act and the Health Insurance Portability and Accounting Act (HIPAA) are the federal laws that most affect our day-to-day operations. These apply to us because we gather and use personal nonpublic information to underwrite insurance and process claims. We also are subject to other federal laws, such as the Terrorism Risk Insurance Act (TRIA), anti-money laundering statute (AML), the Nonadmitted and Reinsurance Reform Act (NRRA), the U.S. Foreign Corrupt Practices Act (FCPA), and the rules and regulations of the Office of Foreign Assets Control (OFAC).

Title V of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank) created the Federal Insurance Office to monitor the insurance industry and gather information to identify issues or gaps in the regulation of insurers that could contribute to a systemic crisis in the insurance industry that affects the United States’ financial system and to recommend to the Financial Stability Oversight Council that it designate an insurer as a systemically significant entity requiring additional supervision by the Federal Reserve Board. We do not expect Dodd-Frank to result in federal oversight of our operations as a systemically significant entity.

We do not expect to have any material effects on our expenditures, earnings or competitive position as a result of compliance with any federal, state or local provisions enacted or adopted relating to the protection of the environment. We currently do not have any material estimated capital expenditures for environmental control facilities.

Cincinnati Financial Corporation - 2024 10-K - Page 27

We operate in limited foreign jurisdictions. Our foreign insurance subsidiary, Cincinnati Global Underwriting Ltd., based in the United Kingdom (U.K.), holds a group of companies led by our managing agency, Cincinnati Global Underwriting Agency Ltd., of Lloyd’s Syndicate 318, which is regulated by The Prudential Regulation Authority (PRA) and The Financial Conduct Authority (FCA). The PRA’s primary objective with respect to insurers is to promote the safety and soundness of insurers for the protection of policyholders, while the FCA has three operational objectives: (i) to secure an appropriate degree of protection for consumers; (ii) to protect and enhance the integrity of the U.K. financial system; and (iii) to promote effective competition in the interests of consumers in the financial services markets. The PRA/FCA’s Senior Managers and Certification Regime provides regulatory frameworks for standards of fitness and propriety, conduct and accountability for individuals in positions of responsibility at insurers. The PRA and FCA have also delegated certain additional regulatory responsibilities to the Council of Lloyd’s. By virtue of Lloyd’s international licenses, we can write business in various countries throughout the world. In each such country, we are subject to the laws and insurance regulations of that jurisdiction.

Our operations in the U.K. are further subject to regulations retained following the U.K.’s exit from the European Union (EU). Generally, these requirements were adopted by the EU and then implemented by enabling legislation in the member countries. Significant areas of oversight in the U.K. include capital, solvency and risk management requirements (Solvency II), competition law and antitrust regulation, intermediary and distribution regulation, climate change, gender discrimination and data protection and privacy (General Data Protection Regulation).

Cincinnati Financial Corporation - 2024 10-K - Page 28

Enterprise Risk Management

We manage enterprise risk, including cybersecurity risk, through formal risk management programs overseen by an executive officer of the company. Our ERM framework includes an enterprise risk management committee, which is responsible for overseeing risk activities and is comprised of senior executive-level risk owners from across the enterprise. The risk committee's activities are supported by a team of representatives from business areas that focus on identifying, evaluating and developing risk plans for emerging risks, including cybersecurity risks. A comprehensive report is provided quarterly to our chairman and chief executive officer and also to our board of directors and our senior executive team, as appropriate, on the status of risk metrics relative to identified tolerances and limits, risk assessments and risk plans. The use of operational audits, strategic plans and departmental business plans, as well as our culture of open communications and fundamental respect for our Code of Conduct, continue to help us manage risks on an ongoing basis. Our efforts to assess, identify and manage material risks from cybersecurity threats is further discussed in Item 1C, Cybersecurity.

Our risk management programs include a formalized risk appetite element and a risk identification and quantification process. The overall enterprise objective is to appropriately balance risk and reward to achieve an appropriate return on risk capital. Our key risks are discussed in Item 1A, Risk Factors, including risks related to natural catastrophes, investments and operations.

We continue to study emerging risks, including climate change risk and its potential financial effects on our results of operations and on those we insure. These effects include deterioration in the credit quality of our municipal or corporate bond portfolios and increased losses without sufficient corresponding increases in premiums. As with any risk, we seek to identify the extent of the risk exposure and possible actions to mitigate potential negative effects of risk at an enterprise level.

Cincinnati Financial Corporation - 2024 10-K - Page 29