FIFTH THIRD BANCORP

Operational risk is the risk to current or projected financial condition and resilience arising from inadequate or failed internal processes or systems, human errors or misconduct or adverse external events that are neither market- nor credit-related. Operational risk is inherent in the Bancorp’s activities and can manifest itself in various ways, including fraudulent acts, business interruptions, inappropriate behavior of employees, unintentional failure to comply with applicable laws and regulations, poor design or delivery of products and services, cybersecurity or physical security incidents and privacy breaches or failure of third parties to perform in accordance with their arrangements. These events could result in financial losses, reputational damage, litigation and regulatory fines or other damage to the Bancorp. The Bancorp’s risk management goal is to keep operational risk at appropriate levels consistent with the Bancorp’s risk appetite, financial strength, the characteristics of its businesses, the markets in which it operates and the competitive and regulatory environment to which it is subject.

To control, monitor and govern operational risk, the Bancorp maintains an overall Enterprise Risk Management Framework which comprises governance oversight, risk assessment, capital measurement, monitoring and reporting as well as a formal three lines of defense approach. ERM is responsible for prescribing the framework to the lines of business and corporate functions and providing independent oversight of its implementation (second line of defense). Business Controls groups are in place in each of the lines of business to ensure consistent implementation and execution of managing day-to-day operational risk (first line of defense).

The Bancorp’s Enterprise Risk Management Framework consists of five integrated components, including identifying, assessing, managing, monitoring and independent governance reporting of risk. The corporate Operational Risk Management function within Enterprise Risk is responsible for developing and overseeing the implementation of the Bancorp’s approach to managing operational risk. This includes providing governance, awareness and training, tools, guidance and oversight to support implementation of key risk programs and systems as they relate to operational risk management. These include programs, such as risk and control self-assessments, product delivery risk assessments, scenario analysis, new product/initiative risk reviews, key risk indicators, Third-Party Risk Management, cybersecurity risk management, review of operational losses and monitoring of significant organizational or process changes. The function is also responsible for developing reports that support the proactive management of operational risk across the enterprise. The lines of business and corporate functions are responsible for managing the operational risks associated with their areas in accordance with the Enterprise Risk Management Framework. The framework is intended to enable the Bancorp to function with a sound and well-controlled operational environment. These processes support the Bancorp’s goals to minimize future operational losses and strengthen the Bancorp’s performance by maintaining sufficient capital to absorb operational losses that are incurred.

The Bancorp also maintains a robust information security program to support the management of cybersecurity risk within the organization with a focus on prevention, detection and recovery processes. Refer to Part I, Item 1C of this report for more information, which is incorporated herein by reference.

External threats remain elevated which may result in increased fraud and cybersecurity risks. The Bancorp’s strategic initiatives also have the potential to increase operational risk as changes to process and technology are implemented. Other factors such as increased reliance on third parties, reliance on data and increased use of cloud-based technologies as well as the use of emerging technologies such as generative models and artificial intelligence may introduce additional operational risk considerations. These risks continue to be carefully managed and monitored to ensure effective controls are in place, with appropriate oversight and governance by the second line of defense.

Fifth Third also focuses on the reporting and escalation of operational control issues to senior management and the Board of Directors. The Operational Risk Committee is the key committee that oversees and supports Fifth Third in the management of operational risk across the enterprise. The Information Security Governance Committee and Model Risk Committee report to the Operational Risk Committee and are responsible for governance of information security and model risks. The Operational Risk Committee reports to the ERMC, which reports to the RCC of the Board of Directors of Fifth Third Bancorp and Fifth Third Bank, National Association.

The Bancorp is aware of and actively monitoring climate-related risks. Climate-related risks could impact the Bancorp in the form of physical risks due to acute or chronic weather-related events that could disrupt the operations of the Bancorp or could impair the ability of clients to meet financial obligations. The Bancorp also faces transition risk resulting from economic transition towards a lower-carbon future which may negatively impact some clients or present credit, strategic or reputational risks to the Bancorp.

Climate risk is a priority for management and accordingly the Board oversees both the RCC and the Nominating and Corporate Governance Committee. The RCC is responsible for overseeing the development and implementation of Fifth Third’s Enterprise Risk Management Framework including climate risks. In the course of business, the Bancorp’s Environmental Risk Group works with partners to manage or mitigate environmental risks including climate-related risks. As part of its larger environmental, social and governance responsibilities the Nominating and Corporate Governance Committee is responsible for overseeing climate strategy and climate-related issues in the context of stakeholder concerns.

102 Fifth Third Bancorp