FIFTH THIRD BANCORP

Effective risk management is critical to the Bancorp’s ongoing success and ensures that the Bancorp operates in a safe and sound manner, complies with applicable laws and regulations and safeguards the Bancorp’s brand and reputation. Risks are inherent in the Bancorp’s business and are influenced by both internal and external factors. The Bancorp is responsible for managing these risks effectively to deliver through-the-cycle value and performance for the Bancorp’s shareholders, customers, employees and communities.

Fifth Third’s Enterprise Risk Management Framework, which is approved annually by the Capital Committee, ERMC, RCC and the Board of Directors, includes the following key elements:

•The Bancorp ensures transparency of risk through defined risk policies, governance and a reporting structure that includes the RCC, ERMC and other risk-specific management committees and councils.

•The Bancorp establishes a risk appetite in alignment with its strategic, financial and capital plans at the enterprise level and the line of business level. Risk appetite is defined using quantitative metrics and qualitative measures to ensure prudent risk taking that drives balanced decision making. The Bancorp’s goal is to ensure that aggregate residual risks do not exceed the Bancorp’s risk appetite, and that risks taken are supportive of the Bancorp’s portfolio diversification and profitability objectives. The Board and executive management approve the risk appetite, which is considered in the development of business strategies and forms the basis for enterprise risk management.

•The core principles that define the Bancorp’s risk appetite are as follows:

◦Conduct the Bancorp’s business in compliance with all applicable laws, rules and regulations and in alignment with internal policies and procedures.

◦Act with integrity in all activities.

◦Understand the risks taken and ensure that they are in alignment with the Bancorp’s business strategies and risk appetite.

◦Avoid risks that cannot be understood, managed or monitored.

◦Provide transparency of risk to the Bancorp’s management and Board by escalating risks and issues as necessary.

◦Ensure Fifth Third’s products and services are designed, delivered and maintained to provide value and benefit to the Bancorp’s customers and to Fifth Third.

◦Only offer products or services that are appropriate or suitable for the Bancorp’s customers.

◦Focus on providing operational excellence by providing reliable, accurate and efficient services to meet customers’ needs.

◦Maintain a strong financial position to ensure the Bancorp meets its strategic objectives through all economic cycles and is able to access the capital markets at all times, even under stressed conditions.

◦Protect the Bancorp’s reputation by thoroughly understanding the consequences of business strategies, products and processes.

•Fifth Third’s culture and values provide the foundation for supporting sound risk management practices by setting expectations for appropriate conduct and accountability across the organization. All employees are expected to conduct themselves in alignment with Fifth Third’s Code of Business Conduct and Ethics, which may be found on www.53.com, while carrying out their responsibilities. Fifth Third’s Management Compliance Committee provides oversight of business conduct policies, programs and strategies, and monitors reporting of potential misconduct, trends or themes across the enterprise. Prudent risk management is a responsibility that is expected from all employees and is a foundational element of Fifth Third’s culture.

•The Bancorp manages eight defined risk types to a prescribed appetite. The risk types are credit risk, liquidity risk, interest rate risk, price risk, legal and regulatory compliance risk, operational risk, reputation risk and strategic risk.

•The Bancorp identifies and monitors existing and potential risks that may impact the company’s risk profile, including emerging risks that create uncertainties and/or would have broad implications if materialized (e.g., digital assets, acute weather events, etc.). Enhanced monitoring and action plans are implemented as necessary to proactively mitigate risk.

•Fifth Third’s Risk Management Process provides a consistent and integrated approach for managing risks. The five components of the Risk Management Process are: identify, assess, manage, monitor and report. The Bancorp has also established processes and programs to manage and report concentration risks, to ensure robust talent, performance and compensation management, and to aggregate risks across the enterprise.

Fifth Third drives accountability for managing risk through its Three Lines of Defense structure. The first line of defense is comprised of front-line units (and enterprise-wide functions that support front-line units) that create risk or are involved in risk-taking activities and are accountable for managing risk. These groups are the Bancorp’s primary risk takers and are responsible for implementing effective internal controls and maintaining processes for identifying, assessing, managing, monitoring and reporting on the risks associated with their activities consistent with established risk appetite and limits. The second line of defense, or Independent Risk Management, consists of Enterprise and Non-Financial Risk Management, Capital Markets Risk Management, Compliance, Financial Crimes, Model Risk Management, Credit Risk Management (collectively known as Enterprise Risk Management) and other second line of defense groups, such as Credit Risk Review. The second line is responsible for developing enterprise frameworks and policies to govern risk-taking activities, providing challenge and oversight of those activities, advising on controlling risk, assessing risks and issues independent of the first line of defense, and providing input on key risk decisions. Independent Risk Management complements the front line’s management of risk-taking activities through its monitoring and reporting responsibilities, including adherence to the Bancorp Risk Appetite. Additionally, the second line of defense is responsible for identifying, assessing, managing, monitoring and reporting on aggregate risks enterprise-wide. The third line of defense is Internal Audit, which provides oversight of the first and second lines of defense, and independent assurance to the Board on the effectiveness of governance, risk management and internal controls.

76 Fifth Third Bancorp