FIFTH THIRD BANCORP

Legal and regulatory compliance risk is the risk of legal or regulatory sanctions, financial loss or damage to reputation as a result of noncompliance with (i) applicable laws, regulations, rules and other regulatory requirements (including but not limited to the risk of consumers experiencing economic loss or other legal harm as a result of noncompliance with consumer protection laws, regulations and requirements); (ii) internal policies and procedures, standards of best practice or codes of conduct; and (iii) principles of integrity and fair dealing applicable to Fifth Third’s activities and functions. Legal risks include the risk of actions against the institution that result in unenforceable contracts, lawsuits, legal sanctions, or adverse judgments, which disrupt or otherwise negatively affect the operations or condition of the institution. Failure to effectively manage such risks can elevate the risk level or manifest itself as other types of key risks, including reputational or operational risk. Fifth Third focuses on managing legal and regulatory compliance risk in accordance with the Bancorp’s integrated enterprise risk management framework, which ensures consistent processes for identifying, assessing, managing, monitoring and reporting risks. The Bancorp’s risk management goal is to keep compliance risk at appropriate levels, consistent with the Bancorp’s risk appetite.

To mitigate such risks, Compliance Risk Management provides independent oversight to foster consistency and sufficiency in the execution of the program, and ensures that lines of business and support functions are adequately identifying, assessing and monitoring legal and regulatory compliance risks and adopting proper mitigation strategies. Moreover, such strategies are modified from time to time to respond to new or emerging risks in the environment. Compliance Risk Management and the Legal Division provide guidance to the lines of business and enterprise functions, which are ultimately responsible for managing such risks associated with their areas. The Chief Compliance Officer is responsible for formulating and directing the strategy, development, implementation, communication and maintenance of the Compliance Risk Management program, which implements key compliance processes, including but not limited to, executive- and board-level governance and reporting routines, compliance-related policies, risk assessments, key risk indicators, issues tracking, regulatory change management and regulatory compliance testing and monitoring. In partnership with Compliance Risk Management, the Financial Crimes Division conducts and oversees anti-money laundering and economic sanctions processes. Compliance Risk Management also partners with the Community and Economic Development team to oversee the Bancorp’s compliance with the Community Reinvestment Act.

Fifth Third also reports and escalates legal and regulatory compliance risks to senior management and the Board of Directors. The Management Compliance Committee, which is chaired by the Chief Compliance Officer, is the key committee that oversees and supports Fifth Third in the management of compliance risk across the enterprise. The Management Compliance Committee oversees Bancorp-wide compliance issues, industry best practices, legislative developments, regulatory concerns and other leading indicators of legal and regulatory compliance risk. The Management Compliance Committee reports to the ERMC, which reports to the RCC of the Board of Directors of Fifth Third Bancorp and Fifth Third Bank, National Association.

107 Fifth Third Bancorp